everyday mac tools

"Operation not permitted" in Terminal on a Mac, even with sudo

· 6 min read

Terminal prints “Operation not permitted” when a macOS protection refuses the action, even though the file’s ordinary permissions would allow it. That’s why sudo doesn’t help: the protections apply to root as well. Four things cause it: a privacy setting that hasn’t let your terminal app into a folder, System Integrity Protection, a file flag such as uchg, and App Management. The path in the command usually tells you which one, and each has its own fix.

Operation not permitted is not Permission denied

The two messages come from different checks. “Permission denied” means the file’s owner, group or mode bits don’t let you in, and sudo or chmod can fix it. “Operation not permitted” means the ordinary permissions were fine, but a protection layer said no.

Here is a real one from a Mac running macOS 15.6, trying to create a file in a system folder:

touch /System/x
touch: /System/x: Operation not permitted

Work through the checks below in order. The first one is the most likely for a folder in your home folder, and the cheapest to fix.

Check one: Terminal isn’t allowed into that folder

If the path is in Desktop, Documents or Downloads, or holds Mail, Messages or Safari data, suspect privacy permissions. The command is usually a read: ls, cat, cp or find failing on a folder you own. If you once clicked Don’t Allow when macOS said Terminal “would like to access files in your Documents folder”, this is the result.

The permission belongs to the app you typed the command in, not to the command. That’s Terminal for most people. If you use another terminal app, or the terminal built into an editor such as VS Code, give the permission to that app instead.

  1. Open System Settings and click Privacy & Security.
  2. Click Full Disk Access, or Files & Folders if you’d rather grant less.
  3. Turn on your terminal app. In Full Disk Access, if it isn’t listed, click the Add button, choose the app (Terminal is in Applications, then Utilities), and click Open.
  4. Quit the app completely and open it again. macOS warns that the app “will not have full disk access until it is quit.”

The Full Disk Access list itself says it covers data like Mail, Messages, Safari, Home and Time Machine backups. Everything you run in that terminal inherits the access, including scripts you didn’t write. Files & Folders is narrower: it grants one location at a time, but it lists only apps that have already asked. What Full Disk Access grants covers the trade-off in more detail.

Working over SSH is a separate case. On the Mac you connect to, open System Settings, click General, then Sharing, click the Info button next to Remote Login, and select “Allow full disk access for remote users”.

Check two: the path belongs to macOS itself

Apple lists /System, /usr, /bin, /sbin and the apps that come with macOS as protected by System Integrity Protection, and names /usr/local, /Applications and /Library as places other software can still write to. Even root can’t change the protected paths. You can see the marker with ls:

ls -ldO /System /usr /usr/local
drwxr-xr-x@ 10 root  wheel  restricted         320 19 Jul  2025 /System
drwxr-xr-x@ 11 root  wheel  restricted,hidden  352 19 Jul  2025 /usr
drwxr-xr-x  15 root  wheel  sunlnk             480 17 Aug  2025 /usr/local

That output is from the same Mac. restricted marks a protected folder; /usr/local doesn’t have it. The fix is to leave those paths alone and put your own tools under /usr/local or in your home folder, which is why Homebrew installs outside the system folders. System Integrity Protection explained covers what it guards.

Check three: the file carries a flag

A file can be marked unchangeable even when you own it. The Locked checkbox in a file’s Get Info window in Finder is this flag: it sets uchg. Look for it with the -O option, which ls documents as adding file flags to a long listing:

ls -lO notes.txt

If the flags column shows uchg, clear it and try again:

chflags nouchg notes.txt

The chflags manual says the owner or the super-user can clear the user flag this way. The system version, schg, can only be set by the super-user, and clearing it is rarely the right answer: if you see it on something macOS installed, leave it. What Finder’s Locked checkbox does explains the same flag from the Finder side.

Check four: you’re changing another app

Since macOS 13 Ventura, one app changing or deleting another app’s bundle needs the App Management permission, and Terminal counts as the app doing it. macOS may also show a notification that “Terminal” was prevented from modifying apps on your Mac. Deleting an app in /Applications from the command line, editing files inside it, or running xattr on it can all end in “Operation not permitted” for this reason.

Open Privacy & Security, click App Management, turn on your terminal app, then quit and reopen it. The list’s own description is “Allow the applications below to update or delete other applications.” Turn it off again when the job is done.

What not to do

  • Don’t turn off System Integrity Protection to get past this. Forum answers that start with restarting into Recovery to switch it off skip the real cause. Privacy, flags and App Management each have a switch of their own, and files under the protected system folders belong somewhere else.
  • Don’t run everything with sudo out of habit. It gets past none of these checks, and it makes real mistakes more expensive.
  • Don’t leave Full Disk Access on for a one-off job. Turn your terminal app off in the list once the job is finished.

If Terminal says “command not found” rather than “Operation not permitted”, that’s a different problem: see zsh: command not found.

Questions

Why does sudo say Operation not permitted on a Mac? Because sudo only changes which user runs the command, and these protections apply to root too. The block comes from a privacy setting, System Integrity Protection, a file flag or App Management, and each has its own fix.

What is the difference between Operation not permitted and Permission denied? “Permission denied” is the ordinary file permission check, and sudo or chmod usually gets past it. “Operation not permitted” means a separate macOS protection refused the action even though the ordinary permissions allowed it.

Why can’t I delete a file with rm on a Mac? Run ls -lO on it. If the flags column shows uchg, clear it with chflags nouchg, or untick Locked in Finder’s Get Info window. If the file is under /System or /usr, it’s part of macOS and shouldn’t be removed. Otherwise check your terminal app’s privacy permissions.

Do I need to restart the Mac after giving Terminal Full Disk Access? No, but you do need to quit Terminal and open it again. macOS says the app won’t have full disk access until it is quit, so reopening it is the step that matters.