A LaunchAgent gets `Operation not permitted` for `~/Documents` while Terminal works
The same zsh script could list ~/Documents when I ran it in Terminal. Started as a LaunchAgent, it failed with: ls: /Users/administrator/Documents: Operation not permitted The LaunchAgent had the same user ID, the same $HOME , and the same script. That combination makes this look like a Unix permission problem. In this test it was not. The useful discriminator was the launch context: access…
A LaunchAgent experienced a permission error when attempting to access the ~/Documents directory, despite the Terminal accessing it without issue. Both the LaunchAgent and Terminal had the same user ID, home directory, and script, leading to suspicion of a Unix permission problem. However, the issue was not with the file ownership or permissions.
The discrepancy was found to be in the launch context, specifically the privacy context associated with how the process was launched. The Terminal had an access that allowed it to read the user's Documents folder, while the LaunchAgent did not inherit this access when started by launchd. This explains why the launch context played a crucial role in the permission denial.
The smallest diagnostic to uncover the issue is to run an identical read from the interactive application and the scheduled process, then add a control path outside the protected folders. If only the protected folder fails, the focus should be on the macOS privacy context of the scheduled process. Additionally, enable pipeline failure in the diagnostic script to capture and handle the status immediately, preventing the denial from being hidden by a successful command.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
