macOS: Operation not permitted (Full Disk Access / TCC)

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# Confirm it is TCC and not POSIX permissions
ls -le ~/Documents        # extended ACLs
ls -lO ~/Documents        # file flags

# Grant to the app that launches your process:
# System Settings -> Privacy & Security -> Full Disk Access
# add Terminal / iTerm / your IDE, then fully quit and relaunch it

# Check what was denied
log show --predicate 'subsystem == "com.apple.TCC"' --last 10m

How to diagnose Apple errors

macOS developer errors concentrate around three subsystems: the command line tools (xcrun and the active developer directory), the dynamic linker (dyld, library paths, and code signing), and Gatekeeper / notarisation. Apple Silicon added a fourth axis: architecture mismatches between arm64 and x86_64 binaries, which usually surface as confusing "library not loaded" or "bad CPU type" messages rather than as an explicit architecture error.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Check the active developer directory first with xcode-select -p. After every macOS or Xcode update this can point at a path that no longer exists, breaking git, compilers and package managers all at once.
2. For dyld errors, run otool -L /path/to/binary to list what it actually wants, then verify each path exists. DYLD_PRINT_LIBRARIES=1 shows the resolution order at runtime.
3. Confirm architecture with file /path/to/binary and uname -m. On Apple Silicon, a Rosetta shell reports x86_64 and will silently install the wrong Homebrew prefix.
4. Homebrew lives at /opt/homebrew on Apple Silicon and /usr/local on Intel. Permission errors under /usr/local on an M-series Mac almost always mean a Rosetta/native mix-up.
5. For Gatekeeper and notarisation, use spctl -a -vvv to assess a bundle and xcrun notarytool log to get the actual rejection reason. The submission status alone tells you nothing useful.

Tools worth reaching for

• xcode-select -p
• otool -L
• codesign -dv --verbose=4
• spctl -a -vvv
• xcrun notarytool log

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 support.apple.com

Related Apple errors

• Homebrew: Permission denied @ /usr/localHomebrew cannot write to its prefix because directory ownership is wrong, common on Intel…
• macOS: cannot be opened because the developer cannot be verifiedGatekeeper blocked something that carries the quarantine attribute and is not notarised…
• macOS: dyld: Library not loadedThe dynamic linker could not find a shared library at the path baked into the binary, often…
• macOS: errSecAuthFailed / Keychain access deniedA code-signing or credential operation could not read the Keychain, common in CI when the…
• macOS: notarization failed (notarytool)Apple's notary service rejected the app, usually for unsigned/un-hardened binaries, a missing…
• macOS: xcrun: error: invalid active developer pathThe Command Line Tools path is missing or points to a removed Xcode, commonly after a macOS…
• macOS: zsh: command not found after Homebrew install (PATH)A freshly installed CLI is not on PATH because the Homebrew shellenv was not added to the…
• Xcode: Command PhaseScriptExecution failed with a nonzero exit codeA Run Script build phase exited non zero, and Xcode reports its own wrapper rather than the…

See all 10 Apple errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.