MacOS Sonoma cron job doesn't have access to ~/.Trash even though it has full system access

MacOS Sonoma Version 14.2.1

I am running a python script via crontab, and the script runs, but I get an error when trying to iterate the ~/.Trash directory:

PermissionError: [Errno 1] Operation not permitted: '/Users/me/.Trash'

I have enabled full disk access for: /usr/sbin/cron, /usr/bin/crontab, and terminal.app, but still have the same problem.

If I run the script directly, it works fine, but when cron runs it, I get the error above. ~/.Trash is the only directory that I've found to have problems with. I've tried both using absolute path and relative to my home directory .

I have tried a few different crontab entries, but get the same result from all of them (I've ran each version directly and each works fine when not ran via cron).

  1. */5 * * * * /Users/me/miniforge3/envs/dev/bin/fclean >> /dev/null 2>&1

  2. */5 * * * * /Users/me/miniforge3/envs/dev/bin/python /Users/me/miniforge3/envs/dev/bin/fclean >> /dev/null 2>&1

  3. */5 * * * * /Users/me/miniforge3/envs/dev/bin/python /Users/me/path/to/file.py >> /dev/null 2>&1

if it's helpful the python function that's raising the permission issue is:

def clean_folder(folder: Path, _time: int = days(30)) -> None:
    """
    If a file in the specified path hasn't been accessed in the specified days; remove it.

    Args:
        folder (Path): Path to folder to iterate through
        _time (int): optional time parameter to pass as expiration time.

    Returns:
        None
    """

    for file in folder.iterdir():
        if expired(file, _time):
            try:
                rm_files(file)
            except PermissionError as permission:
                logging.exception(permission)
                continue
            except Exception as _err:
                logging.exception(_err)
                continue
``

Answered by DTS Engineer in 778543022

Scripting and TCC are uneasy bedfellows, because:

  • TCC needs to work out the responsible code for a given request, and

  • TCC needs to be able to reliably track the identity of code

neither of which is easy for a script. I talk about this more in On File System Permissions.

Is it just the Trash you’re having problems with? If, just for testing, you tweak your script to access some other FDA-protected directory, does it fail there as well?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Accepted Answer

Scripting and TCC are uneasy bedfellows, because:

  • TCC needs to work out the responsible code for a given request, and

  • TCC needs to be able to reliably track the identity of code

neither of which is easy for a script. I talk about this more in On File System Permissions.

Is it just the Trash you’re having problems with? If, just for testing, you tweak your script to access some other FDA-protected directory, does it fail there as well?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hey there @eskimo ,

Thank you so much for the response.

I'm currently only having issues with the Trash directory, but I'm happy to test any other directory. I initially tried to set up some test directories in the '/opt/' directory, but I'm getting an Error[13] when I try to run manually (not via cron) from my user account and I'm sure that's because root owns the directory (which is confirmed in the article you wrote). So I wasn't sure what directory I should attempt to access that will show if this is an FDA issue or something else.

If it's helpful, other than the ~/.Trash, my script does access ~/Documents ~/Desktop without any issues when ran from cron (Which I think may have been protected by FDA when ran by cron).

MacOS Sonoma cron job doesn't have access to ~/.Trash even though it has full system access
 
 
Q