Unfortunately, removable disks also fail, which is a nightmare for servers with external disks. I never thought Apple would break macOS so badly that I'd miss Linux, but this does. The launchd plist desperately needs to allow you to control on a per-daemon basis what a daemon's sandbox includes. The current behavior is just plain evil. I'm having to give full disk access to httpd, php, perl, named, etc. (which is entirely the wrong way to do security), because there's nothing fine-grained.
Topic:
App & System Services
SubTopic:
Core OS
Tags: