Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

operation not permitted running shell scripts

Hello,


I have already done the full disk access to terminal step as suggested. All commands in my text script (just simple command lines like "mv x y"). All commands work when I place them at the prompt. I used chmod +x script.sh, also sudo chmod +x script.sh, chmod 755 script.sh, chmod ugo+x script.sh and ugo+x script.sh...all of these seem to work until I type ./script.sh, at which point I get:


"zsh: operation not permitted: ./script.sh"


I even put in my script just the simple line: print "Hello world\n"


and it ages me the same output: "zsh: operation not permitted: ./script.sh"


the other solution I found seemed rather drastic since the commands themselves, outside the script, work fine, was to To Disable System Integrity Protection On the Mac!


what is the problem!


thank you.



MacBook Pro 13″, macOS 12.1

Posted on Feb 19, 2022 4:00 PM

Reply
Question marked as Best reply

Posted on Feb 20, 2022 11:11 AM

This particular file probably wasn't created locally, but probably started its existence on this Mac as a file downloaded from some website, and the quarantine flag is set on downloads to prevent drive-by and other security shenanigans.


Remove the quarantine flag:


xattr -d com.apple.quarantine ./script.sh


And off you go...


Files created locally don't get this flag set, nor do the results of properly-signed app and package installs, but random files downloaded do get quarantined. The quarantine flag was first added in OS X 10.5 Leopard, so any macOS version you're likely to encounter now will set this flag for downloaded files, too.

Similar questions

9 replies
Question marked as Best reply

Feb 20, 2022 11:11 AM in response to ursula60

This particular file probably wasn't created locally, but probably started its existence on this Mac as a file downloaded from some website, and the quarantine flag is set on downloads to prevent drive-by and other security shenanigans.


Remove the quarantine flag:


xattr -d com.apple.quarantine ./script.sh


And off you go...


Files created locally don't get this flag set, nor do the results of properly-signed app and package installs, but random files downloaded do get quarantined. The quarantine flag was first added in OS X 10.5 Leopard, so any macOS version you're likely to encounter now will set this flag for downloaded files, too.

Feb 20, 2022 10:03 AM in response to ursula60

Your script has an extended attribute (@) present, and attributes can block execution—such as with the quarantine attribute.


Here's a newly created script showing a similar failure, this failure due to a lack of execute protection. The protection error is subsequently corrected with a chmod u+x command.


% cat script.sh
#!/usr/bin/env zsh
print "Hello world\n"
% ls -ale@ script.sh
-rw-r--r--  1 mrhoffman  staff  33 Feb 20 12:34 script.sh
% ./script.sh
zsh: permission denied: ./script.sh
% chmod u+x script.sh
% ls -ale@ script.sh
-rwxr--r--  1 mrhoffman  staff  33 Feb 20 12:34 script.sh
% ./script.sh        
Hello world

% 


The script example above also includes a "shebang", and the #!/path causes the script to get the expected shell for the script—scripts can be written in various shells and various other tools.


It's usually best to specify the shell. Either /usr/bin/env zsh or /bin/zsh for the zsh shell is common; the former syntax takes your PATH into account and the latter does not, which may or may not be desirable for any particular case.


Your failure here is probably due to the @ attribute.


Post the output of the following updated (@ added) command:


ls -ale@ ./script.sh


That command will show which attributes are present, and we can work from there to identify and remove the @ attribute.


ps: from Apple: Shell Script Basics

Feb 19, 2022 4:53 PM in response to ursula60

Issue the following commands for the “hello world” shell script, and post the results here—from what has been posted, it’s not clear if this is an issue with the protections (unlikely, given all the different chmod commands used), something with the script invocation, or with a commands included within the script.


ls -ale ./script.sh
cat ./script.sh
echo $PATH


Feb 20, 2022 10:46 AM in response to MrHoffman

MrHoffman,


So here is the output for the original script following command

cat script.sh 


print "Hello world\n"% 


then:


ls -ale@ script.sh


-rwxr-xr-x@ 1 ursulaps  staff  21 Feb 20 09:14 script.sh

com.apple.TextEncoding 15 

com.apple.lastuseddate#PS 16 

com.apple.macl 72 

com.apple.metadata:_kMDItemUserTags 42 

com.apple.quarantine 23 


when adding a top line to the script:

cat script.sh 


#!/usr/bin/env zsh

print "Hello world\n"% 


then a new line appears when I do ls ( though permissions seem identical):


ls -ale@ script.sh


-rwxr-xr-x@ 1 ursulaps  staff  40 Feb 20 10:29 script.sh

com.apple.TextEncoding 15 

com.apple.lastuseddate#PS 16 

com.apple.macl 72 

com.apple.metadata:_kMDItemUserTags 42 

com.apple.metadata:kMDLabel_fe723mn7r3emt2w3pu26nnxzde 89 

com.apple.quarantine 23


if I remove #! the output is the same as above for "ls -ale@


In all cases above, I then did chmod u+x script.sh


and the output was unfortunately the same:


zsh: operation not permitted: ./script.sh


thanks!

Feb 20, 2022 1:02 PM in response to MrHoffman

Hello MrHoffman!


Again thank you.


We are running :-)

.... but not there yet 100%.....


First I want to clarify that I did create the file myself. Just opened a TextEdit window using plain text and wrote the lines for the script (the "mv x y"). Then I tried an example from the internet: the one saying print "Hello world/n". And I wrote it, not copy-paste.


So three things:


1) if my script is of the type:


mv x y

mv z w


and I first run:

xattr -d com.apple.quarantine ./script.sh


and then:

./script.sh


it works!


HOWEVER, every time I change script.sh I have to do the two steps again:


first:

xattr -d com.apple.quarantine ./script.sh


and then:

./script.sh


which is annoying (but that is much better than not functioning at all!! so thank you)...


but then how to remove that "com.apple.quarantine" for good so that I then just use ./script.sh always?


2) So maybe, going back to the discussion on shells, it's the shell I am using. What type of shell would be best? bash or? indeed this zsh is new to me....


3) Last thing; interestingly a new issue appeared with the script when it was simply:

print "hello world/n"


after the same procedure as you suggest it ran but then complaint! with this:

./script.sh: line 1: print: command not found


if I copy the line on the prompt however it runs perfectly fine...this is really odd ....


thank you again!

-ursula






Feb 20, 2022 1:32 PM in response to ursula60

BBEdit is a better choice for a GUI editor for command-line text files, or you can use pico or another text editor that's available at the command line.


I use the vim editor and its MacVim relative, and that and emacs and other available text editors can be more complex than might be appropriate—for now.


Most of the GUI editors and document-editing tools tend to not create plain text files quite the way the command line wants.


The use of TextEdit might explain the spacing in your scripts.


On macOS Monterey, TextEdit doesn't add the quarantine flag, so I'm not sure how that keeps getting re-added here. Are you possibly writing your script files someplace more unusual, and that's then adding the quarantine flag? Not somewhere under your home directory, which would be expected while developing a script. Maybe on a network share?


The baseline BBEdit app is free, and has replaced the equivalent TextWrangler, and works well with plain-text files.


At the command line, the pico editor is included in macOS, and shows its common commands right in the editing session.


pico ./script.sh


zsh is the default shell on recent macOS, though bash and other shells are available. Up until recently, bash was the default shell. If you're just getting going with shell scripts on macOS and you're using recent macOS versions, then zsh is likely the best choice, and then using bash if and where that's required.


Create a new script in a new file using BBEdit or pico, and enter the shebang and the print command there, chmod u+x, and invoke that.


pico ./script_2.sh

Feb 20, 2022 5:49 PM in response to MrHoffman

Hello MrHoffman,


so yes, if I use pico it doesn't create the:


com.apple.quarantine


and thus I do not have to remove it with


xattr -d com.apple.quarantine


every time I use TextEdit (to edit and save my script) it creates com.apple.quarantine. The script is not buried at a weird location. But to check I put it on the Desktop and the problem persists. That is, if I make my script in TextEdit it adds this quarantine line! Who should I contact at Apple to bring this to their attention! Indeed, in my previous MacBookPro, this was not happening.


Overall I would say I can now work :-) So thanks so much!


Because my scripts are generally more complex that just "mv xy" I would like to understand why a script with:

print "hello" is not working even if created with pico: Here is what happens:


ursulaps@Ursulas-MacBook-Pro Desktop % print "hello"


hello


ursulaps@Ursulas-MacBook-Pro Desktop % cat new.txt 


print "hello"


ursulaps@Ursulas-MacBook-Pro Desktop % ./new.txt 


./new.txt: line 1: print: command not found


I thought maybe the problem is the double quotes which I type using the double quote key. But I copied the command after using cat (as shown), and pasted it to the command line and it runs fine...any ideas.


Sorry I am obsessing but I feel that this issue will appear with other commands as well if I do not why this is failing to execute.


Thank you for your help and patience!

-ursula




Feb 20, 2022 6:05 PM in response to ursula60

Please specify the shebang, as was shown.


#!/usr/bin/env zsh
print "Hello world\n


You’re changing up the file extensions, and a .txt text file type is not usually used for shell scripts. Best to stick with the standard file types too, lest the tools get confused. Usually, use .sh for shell scripts, or use no type at all and the shebang.


Please also see the Apple scripting primer link that was posted earlier.


The shell is very sensitive to syntax, and mistakes with mv or rm or such commands can clobber your other files. Filenames in particular can have embedded spaces, and the shell commands require those spaces to be escaped, or the filenames quoted.


Until you’re a bit more comfortable using the shell, maybe use a separate macOS login for testing, as that will usually isolate the damage from mistakes.


Have complete and current backups.

operation not permitted running shell scripts

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.