Fix macOS 'Operation Not Permitted' in Terminal on Big Sur+

Quick Answer

Grant Full Disk Access to your terminal app (Terminal, iTerm, VS Code) in System Settings > Privacy & Security > Full Disk Access, then restart the app.

Why This Happens

Starting with macOS Big Sur (11), Apple locked down Desktop, Documents, and Downloads folders even for apps you run locally. The system uses a database called TCC (Transparency, Consent, and Control) to decide who gets in. When you type ls ~/Desktop in Terminal and get Operation not permitted, it's not a Unix permissions problem — it's macOS saying "I don't trust you enough to look at those files."

I had a client last month whose backup script silently failed every night because of this. The script ran fine in a test window, but once Terminal wasn't the active app, the TCC prompt never appeared and the job died. You're probably hitting the same wall.

Fix Steps

1. Open System Settings (or System Preferences on older macOS). Go to Privacy & Security > Full Disk Access.
2. Click the + button. If it's greyed out, click the padlock and enter your admin password.
3. Navigate to /Applications/Utilities/ and select Terminal. If you use iTerm2, pick that from /Applications instead. For VS Code, find the app bundle and add it.
4. After adding, quit the terminal app (Cmd+Q) and reopen it. The permission only takes effect on launch.
5. Test with ls ~/Desktop. If it lists files, you're done.

That's the fix for most people. But sometimes the TCC database gets corrupted or the permission doesn't stick — especially after a macOS update. Here's what to do then.

If Full Disk Access Doesn't Work

Reset the TCC database. This is the nuclear option, but it works when permissions look right and still fail.

sudo tccutil reset All

That wipes every app's privacy permission — you'll need to re-grant things like camera and mic access. If you only want to reset the terminal app, run:

sudo tccutil reset All com.apple.Terminal

Replace com.apple.Terminal with the bundle ID if you're using another app (iTerm2 is com.googlecode.iterm2).

Still stuck? Check if the folder itself has odd flags. Sometimes a previous crash leaves ACLs that block even root.

ls -lOe ~/Desktop

If you see restricted or hidden flags, remove them with:

sudo chflags -R norestricted ~/Desktop

But be careful — only do this on the specific folder, not the whole home directory.

Alternative Fixes

• Use a different terminal app — sometimes the TCC entry for one app gets stuck. Try iTerm2 or even the built-in Terminal if you were using another.
• Move your files out of protected folders — not ideal, but if you just need to get work done, copy that one project to ~/Projects and set up a symlink. Hacky, but I've done it.
• Refresh the terminal app — drag the app to Trash, reinstall from a fresh download. This resets its code signature, which sometimes makes TCC see it as a new app.

Prevention Tips

First, never run sudo on every command. I see people doing sudo ls out of habit, and that triggers more TCC headaches because root has its own separate access rules.

Second, keep your macOS updated. Apple has squashed several TCC bugs in point releases. The permissions dialogue is also less glitchy on recent versions.

Third, if you're a developer, explicitly grant Full Disk Access to your code editor and terminal before you start a big project. Doing it mid-stream after hours of work is a pain — I've been there.

That's it. Get that permission set and you're back to normal. If it still fails after all this, reboot into Safe Mode and try again — that clears some system caches that mess with TCC. In ten years of doing this, I've only had to resort to that twice.