{"action":"created","issue":{"url":"https://api.github.com/repos/restic/restic/issues/2051","repository_url":"https://api.github.com/repos/restic/restic","labels_url":"https://api.github.com/repos/restic/restic/issues/2051/labels{/name}","comments_url":"https://api.github.com/repos/restic/restic/issues/2051/comments","events_url":"https://api.github.com/repos/restic/restic/issues/2051/events","html_url":"https://github.com/restic/restic/issues/2051","id":371191338,"node_id":"MDU6SXNzdWUzNzExOTEzMzg=","number":2051,"title":"MacOS Mojave: error: Open: ... operation not permitted","user":{"login":"n8henrie","id":1234956,"node_id":"MDQ6VXNlcjEyMzQ5NTY=","avatar_url":"https://avatars1.githubusercontent.com/u/1234956?v=4","gravatar_id":"","url":"https://api.github.com/users/n8henrie","html_url":"https://github.com/n8henrie","followers_url":"https://api.github.com/users/n8henrie/followers","following_url":"https://api.github.com/users/n8henrie/following{/other_user}","gists_url":"https://api.github.com/users/n8henrie/gists{/gist_id}","starred_url":"https://api.github.com/users/n8henrie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/n8henrie/subscriptions","organizations_url":"https://api.github.com/users/n8henrie/orgs","repos_url":"https://api.github.com/users/n8henrie/repos","events_url":"https://api.github.com/users/n8henrie/events{/privacy}","received_events_url":"https://api.github.com/users/n8henrie/received_events","type":"User","site_admin":false},"labels":[{"id":281195162,"node_id":"MDU6TGFiZWwyODExOTUxNjI=","url":"https://api.github.com/repos/restic/restic/labels/platform:Darwin","name":"platform:Darwin","color":"009800","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":19,"created_at":"2018-10-17T17:39:12Z","updated_at":"2018-11-03T15:58:02Z","closed_at":"2018-10-22T08:39:48Z","author_association":"NONE","body":"MacOS Mojave's privacy features seem to limit restic access to files (at least that what seems to be happening), I'm getting permissions errors that I didn't get prior to upgrading.\r\n\r\nMacOS 10.14\r\n\r\nRunning with sudo:\r\n\r\n```\r\ncan not obtain extended attribute com.apple.rootless for /Library/Application Support/com.apple.TCC\r\nerror: Open: open /Library/Application Support/com.apple.TCC: operation not permitted\r\nerror: open /Library/Preferences/com.apple.TimeMachine.plist: operation not permitted\r\n```\r\n\r\n... many other files.\r\n\r\nOutput of `restic version`\r\n--------------------------\r\n\r\n0.9.2 (most recent in homebrew)\r\n\r\nHow did you run restic exactly?\r\n-------------------------------\r\n\r\nSame bash script I've been using for months prior to upgrading to Mojave, run with root privileges.\r\n\r\n```bash\r\nRESTIC_PASSWORD_FILE=\"/path/to/file.txt\" \\\r\nHOME=\"/path/to/homedir\" \\\r\n/usr/local/bin/restic \\\r\n    --repo sftp:myserver.local:my/repo/path \\\r\n    --option='sftp.command=ssh -p REDACTEDPORT -i REDACTEDKEYFILE -o identitiesonly=yes -l restic myserver.local -s sftp' \\\r\n    --exclude-file=\"${DIR}/global-exclude.txt\" \\\r\n    --exclude-if-present='.norestic' \\\r\n    backup \\\r\n    --cleanup-cache \\\r\n    / \\\r\n    &>> /path/to/file.log\r\n```\r\n\r\nWhat backend/server/service did you use to store the repository?\r\n----------------------------------------------------------------\r\n\r\nsftp, as per above. Same repo as previous.\r\n\r\nExpected behavior\r\n-----------------\r\n\r\nHopefully reads and backs up all files when run as root (realizing this may not be a restic issue, but seems like it's certainly a problem for backups).\r\n\r\nActual behavior\r\n---------------\r\n\r\nas per above\r\n\r\nSteps to reproduce the behavior\r\n-------------------------------\r\n\r\n`sudo bash restic-backup.sh` (script above)\r\n\r\nDo you have any idea what may have caused this?\r\n-----------------------------------------------\r\n\r\nMy guess: \r\n\r\n- https://eclecticlight.co/2018/09/06/working-with-mojaves-privacy-protection/\r\n- https://eclecticlight.co/2018/09/17/managing-mojaves-privacy-protection-privacy-controls/\r\n- https://forums.developer.apple.com/thread/108348\r\n\r\nDo you have an idea how to solve the issue?\r\n-------------------------------------------\r\n\r\nNo. What I've tried so far:\r\n\r\n- No libcap on MacOS, so can't use `setcap`.\r\n- Tried adding restic to \"Full Disk Access\" in the new System Preferences -> Security and Privacy pane, no luck.\r\n\r\nDid restic help you or made you happy in any way?\r\n-------------------------------------------------\r\n\r\nAfter years of trying to find a good, reliable, scriptable, open source backup solution, it's the only one that fits the bill. So grateful!"},"comment":{"url":"https://api.github.com/repos/restic/restic/issues/comments/435598580","html_url":"https://github.com/restic/restic/issues/2051#issuecomment-435598580","issue_url":"https://api.github.com/repos/restic/restic/issues/2051","id":435598580,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNTU5ODU4MA==","user":{"login":"n8henrie","id":1234956,"node_id":"MDQ6VXNlcjEyMzQ5NTY=","avatar_url":"https://avatars1.githubusercontent.com/u/1234956?v=4","gravatar_id":"","url":"https://api.github.com/users/n8henrie","html_url":"https://github.com/n8henrie","followers_url":"https://api.github.com/users/n8henrie/followers","following_url":"https://api.github.com/users/n8henrie/following{/other_user}","gists_url":"https://api.github.com/users/n8henrie/gists{/gist_id}","starred_url":"https://api.github.com/users/n8henrie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/n8henrie/subscriptions","organizations_url":"https://api.github.com/users/n8henrie/orgs","repos_url":"https://api.github.com/users/n8henrie/repos","events_url":"https://api.github.com/users/n8henrie/events{/privacy}","received_events_url":"https://api.github.com/users/n8henrie/received_events","type":"User","site_admin":false},"created_at":"2018-11-03T15:58:02Z","updated_at":"2018-11-03T15:58:02Z","author_association":"NONE","body":"A few more updates now that I have my machine back:\r\n\r\nI cannot replicate my successes above in getting a full system backup from my launchd script.\r\n\r\nI've tried adding all of the below to the FDA list (at the same time), and still get the errors:\r\n- restic\r\n- bash\r\n- launchctl\r\n- launchd\r\n- Terminal.app\r\n\r\nJust for experimentation, bare binaries seem to work fine when added to the FDA list and seems to have nothing to do with codesigning. Compare the `ls` binaries provided by MacOS and by Homebrew:\r\n\r\n```shellsession\r\n$ codesign -d /bin/ls\r\nExecutable=/bin/ls\r\n$ codesign -d /usr/local/opt/coreutils/libexec/gnubin/ls\r\n/usr/local/opt/coreutils/libexec/gnubin/ls: code object is not signed at all\r\n```\r\n\r\nBefore and adding to the FDA list:\r\n\r\n```shellsession\r\n$ /bin/ls ~/Library/Mail\r\nls: Mail: Operation not permitted\r\n$ /usr/local/opt/coreutils/libexec/gnubin/ls ~/Library/Mail\r\nls: cannot open directory '/Users/n8henrie/Library/Mail': Operation not permitted\r\n$ # Added to FDA\r\n$ /bin/ls ~/Library/Mail\r\nPersistenceInfo.plist V6\r\n$ /usr/local/opt/coreutils/libexec/gnubin/ls ~/Library/Mail\r\nPersistenceInfo.plist  V6\r\n```\r\n\r\nAdditionally, they work fine when put into a bash script as long as `ls` is in FDA (no need to add `bash` separately), which makes me think I should only need to add `restic`.\r\n\r\nAlso, for comparison running the following Go script errors if not in FDA, but works fine by itself as well as when called from launchd as long as the binary is in FDA (no need to add launchd / launchctl / anything else).\r\n\r\n```golang\r\npackage main\r\n\r\nimport (\r\n\t\"fmt\"\r\n\t\"io/ioutil\"\r\n)\r\n\r\nfunc main() {\r\n\tmatches, err := ioutil.ReadDir(\"/Users/n8henrie/Library/Mail\")\r\n\tif err != nil {\r\n\t\tfmt.Println(\"Err:\", err)\r\n\t} else {\r\n\t\tfor _, match := range matches {\r\n\t\t\tfmt.Println(match.Name())\r\n\t\t}\r\n\t}\r\n}\r\n```\r\n\r\nOutput:\r\n\r\n```shellsession\r\n$ ./gotest\r\nErr: open /Users/n8henrie/Library/Mail: operation not permitted\r\n$ # Add to FDA\r\n$ ./gotest\r\n.DS_Store\r\nPersistenceInfo.plist\r\nV6\r\n```\r\n\r\nNext I'll do some experimenting with Restic to see if I can figure out why it's getting permission errors even when added to FDA (although other binaries seem to be working once added)."}}
{"actor":{"display_login":"n8henrie"}}