Apple New Added 10 September 2026

Xcode: Sandbox: rsync.samba deny(1) file-write-create

Xcode 15 turned on user script sandboxing for new projects, and a build phase tried to write outside the files it declared. The phase is usually not one you wrote: CocoaPods copies frameworks and resources with rsync, and Flutter and React Native ship similar scripts, so the failure appears after an Xcode upgrade rather than a code change.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix

# The setting that is refusing the write
# Build Settings -> Build Options -> User Script Sandboxing
ENABLE_USER_SCRIPT_SANDBOXING = NO

# In a Podfile, so it survives pod install
post_install do |installer|
  installer.pods_project.targets.each do |t|
    t.build_configurations.each do |c|
      c['ENABLE_USER_SCRIPT_SANDBOXING'] = 'NO'
    end
  end
end

# Or keep the sandbox and declare what the phase touches:
# Build Phases -> the script -> Input Files / Output Files

# Confirm the value the build actually used
xcodebuild -showBuildSettings -scheme App | grep -i SANDBOXING

How to diagnose Apple errors

macOS developer errors concentrate around three subsystems: the command line tools (xcrun and the active developer directory), the dynamic linker (dyld, library paths, and code signing), and Gatekeeper / notarisation. Apple Silicon added a fourth axis: architecture mismatches between arm64 and x86_64 binaries, which usually surface as confusing "library not loaded" or "bad CPU type" messages rather than as an explicit architecture error.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

Check the active developer directory first with xcode-select -p. After every macOS or Xcode update this can point at a path that no longer exists, breaking git, compilers and package managers all at once.
For dyld errors, run otool -L /path/to/binary to list what it actually wants, then verify each path exists. DYLD_PRINT_LIBRARIES=1 shows the resolution order at runtime.
Confirm architecture with file /path/to/binary and uname -m. On Apple Silicon, a Rosetta shell reports x86_64 and will silently install the wrong Homebrew prefix.
Homebrew lives at /opt/homebrew on Apple Silicon and /usr/local on Intel. Permission errors under /usr/local on an M-series Mac almost always mean a Rosetta/native mix-up.
For Gatekeeper and notarisation, use spctl -a -vvv to assess a bundle and xcrun notarytool log to get the actual rejection reason. The submission status alone tells you nothing useful.

Tools worth reaching for

xcode-select -p
otool -L
codesign -dv --verbose=4
spctl -a -vvv
xcrun notarytool log

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

developer.apple.com

Related Apple errors

See all 10 Apple errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.