Typical example:

sudo du -xm /System/Volumes/Data | sort -n -o .all-du                                          
du: /System/Volumes/Data/Library/Caches/com.apple.aned: Operation not permitted
du: /System/Volumes/Data/private/var/networkd/db: Operation not permitted
du: /System/Volumes/Data/private/var/db/appinstalld: Operation not permitted

This question asked how to filter them out but I would like to figure out some way to gain permission to search everything on my disk. I don't plan to muck with Apple's private stuff directly but it might help me to figure out what I can do to free up the space.

The du command is just an example. I have the same problems with find and ls and any other command that tries to inspect protected areas on the disk.

  • Would apple.stackexchange.com/questions/5353/… help (it won't show you the content of the directories listed above, but all the others)?
    – nohillside
    Commented Jan 6, 2022 at 14:42
  • Relevant: apple.stackexchange.com/q/367158/24324, especially this comment. I assume your end goal is to accurately determine the space usage on your mac, for that this question has some highly voted answers. Commented Jan 6, 2022 at 17:09
  • This isn't a question about salvaging disk space. It is a question about not getting Operation not permitted errors. @Alin Panaitiu's answer below is what I was looking for. Thank you @Alin Panaitiu
    – pedz
    Commented Jan 8, 2022 at 14:03

2 Answers 2


If a command running with sudo throws Operation not permitted, that usually means that the file in question is protected by SIP.

SIP can be disabled easily, here are the instructions from the Apple website linked above:

To disable SIP, do the following:

  1. Restart your computer in Recovery mode.
  2. Launch Terminal from the Utilities menu.
  3. Run the command csrutil disable.
  4. Restart your computer.

Note that Apple recommends to re-enable SIP as soon as you finish your privileged task:


Disable SIP only temporarily to perform necessary tasks, and reenable it as soon as possible. Failure to reenable SIP when you are done testing leaves your computer vulnerable to malicious code.


I was able to get this to work as follows without disabling SIP:

macOS Sonoma 10.14.1

Change the shell to Z Shell as mentioned in “The default interactive shell is now zsh”: how to deal with the message?)

  1. Click on the Apple menu and choose System Settings.
  2. Choose Users & Groups.
  3. Control-click or right-click on your user account and choose Advanced Options. Enter your password when prompted and press Return or click Unlock.
  4. Click on the drop-down menu next to Login shell and choose the one you want.
  5. Click OK and quit System Settings.

Also, give Terminal.app Full Disk Privileges in Privacy and Security

after this, du -cksh Library/Mail/V10/* works.

I did not need to do the sudo command.

  • Does this also work for /System/Volumes/Data as mentioned in the question?
    – nohillside
    Commented May 6 at 13:50
  • Unfortunately my answer is only useful inside the users own directory.
    – iewebguy
    Commented May 7 at 12:39
  • You don't need to change shells for that, it should work the same for both bash and zsh.
    – nohillside
    Commented May 7 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .