2

I recently upgraded from Mohave to Big Sur, and the shell script I use as a PDF Service has stopped working. The script calls a Python script to process the PDF, and this gives the error "operation not permitted". Thinking that this has to do with the new security restrictions, I tried dragging everything that seemed relevant to Full Disk Access in the Privacy pane of the Security & Privacy settings, but that didn't help. Here is the script with some debugging lines inserted:

#!/bin/sh

export PATH=/Library/TeX/texbin:/usr/local/bin:$PATH

########################################
# Log stdout and stderr (from https://stackoverflow.com/a/20564208).
LOG_FILE=/tmp/pdfbooklog.txt
# Close STDOUT file descriptor
exec 1<&-
# Close STDERR FD
exec 2<&-
# Open STDOUT as $LOG_FILE file for read and write.
exec 1<>$LOG_FILE
# Redirect STDERR to STDOUT
exec 2>&1

########################################
# Get name of file printed and print options (unused).

# name or title of file printed, e.g., document.odt
TITLE="${1:-}"
# space separated options from the print dialog: k1=v1 k2='v2' …
PRINT_OPTIONS="$2"
# Make first (usually only) filename $1.
shift
shift

# Some programs called write files to the current directory, so make sure
# we're somewhere where that will work.
cd /tmp

########################################
# Apparently it's possible to be called with multiple filenames.
# Use a loop to make sure we handle all files listed on the command line.

for f in "$@"
do
    echo "Processing '$f'"
    echo "PATH: $PATH"
    /usr/local/bin/python3 -c 'print("Python works")'
    pdfbook2 --inner-margin=80 "$f"
    open "${f%.pdf}-book.pdf"
done

When I invoke it from the print dialog, this is what is written to the log file:

Processing '/var/folders/2j/w5jh3df55p7f4n05nh_m45jr0000gn/T/printing.11142.10/test.odt.pdf'
PATH: /Library/TeX/texbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
/Users/me/Library/PDF Services/Make PDF booklet.sh: line 40: /usr/local/bin/python3: Operation not permitted
/Users/me/Library/PDF Services/Make PDF booklet.sh: /Library/TeX/texbin/pdfbook2: /usr/bin/env: bad interpreter: Operation not permitted
The file /var/folders/2j/w5jh3df55p7f4n05nh_m45jr0000gn/T/printing.11142.10/test.odt-book.pdf does not exist.
test.odt-book.pdf does not exist.
Done

pdfbook2 is included with MacTeX: it is a Python script that invokes python3 with /usr/bin/env. python3 is in /usr/local/bin (installed with Homebrew), and as the test line shows, I cannot even invoke it directly. What do I have to do to permit Big Sur to run this script?

Update:

  • In case it wasn't clear, the script works when invoked from the Terminal. It only fails when it is invoked from the print dialog.
  • Since Big Sur still has /usr/bin/python3, the script above can be modified to use it. When the PDF Service is invoked from the print dialog, /usr/bin/python3 -c 'print("Python works")' will print "Python works". /usr/bin/python3 /Library/TeX/texbin/pdfbook2 --inner-margin=80 "$f" will begin executing, but pdfbook2 will then throw a PermissionError of "Operation not permitted" when it tries to run pdfcrop, which is also in /Library/TeX/texbin.
  • The first line of pdfbook2 is #!/usr/bin/env python3. The first line of pdfcrop is #!/usr/bin/env perl, which should find /usr/bin/perl, since there is no Perl in my /usr/local/bin.
  • So apparently SIP is preventing PDF Services from execing anything that is not in a protected directory, and from using /usr/bin/env as an interpreter (which could circumvent that restriction). Is there any way to give a script permission to do this? Giving the script Full Disk Access doesn't work.
7
  • WHat happens if you just try to run python on the command line? – mmmmmm Feb 15 at 11:05
  • 1
    Just to say I've come across this too, for my PDF Services that are pure python scripts. I've reported it as a bug, for all the good that will do. – benwiggy Feb 15 at 11:13
  • @mmmmmm, /usr/local/bin/python3 -c 'print("Python works")' works on the command line (Terminal), and indeed the whole script works if invoked from the Terminal. It fails when it runs as a PDF Service from the print dialog. – jcr Feb 15 at 15:38
  • I see from the second line of the update you say /usr/bin/python3, and say tyhat works but the text you say /usr/local/bin/python3 – mmmmmm Feb 15 at 15:48
  • 1
    @bigwiggy, since no one has offered a solution, I too have reported it as a bug with Feedback Assistant. – jcr Feb 17 at 10:32
2

I have discovered that Big Sur will graciously allow a script to execute in a PDF Service, if the script is put inside an Automator workflow saved as an APPLICATION. Saving as a Print plug-in, workflow, or other type will not work.

Use the 'Run Shell Script' Automator action, and place the script in there.

Whether the script can call another script with the necessary permissions, I have not tried.

1
  • 1
    I made an application with Automator and placed the for f in "$@" loop in a Run Shell Script action: that gave me an application that will make booklets. Then I exported the application to ~/Applications and modified my shell script to pass the PDFs to the application with open instead of running the for loop. It's now working. So it is indeed possible to call another script from the Run Shell Script action. – jcr Apr 8 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .