macOS runner: "Operation not permitted" (SIP / Gatekeeper) in CI

By Kaveh Alemi·Latchkey

macOS refused an operation that System Integrity Protection or Gatekeeper guards. Common cases are writing to a protected system directory, or launching a downloaded binary with the quarantine attribute that Gatekeeper kills.

What this error means

A step fails with "Operation not permitted" when writing under a protected path, or a downloaded tool is "killed" / "cannot be opened because the developer cannot be verified".

macOS

cp: /usr/lib/some.dylib: Operation not permitted
zsh: killed     ./downloaded-tool

Common causes

Writing to a SIP-protected directory

SIP blocks modification of system locations such as /usr (except /usr/local), /System, and /bin even for root, so writes there return "Operation not permitted".

Gatekeeper quarantine on a downloaded binary

Files fetched over the network carry a quarantine attribute; Gatekeeper refuses to run unsigned, unnotarized ones and the process is killed.

How to fix it

Write to a permitted location

Install into /usr/local, /opt, or the workspace rather than SIP-protected system paths.

Terminal

cp some.dylib /usr/local/lib/   # not /usr/lib

Clear quarantine on trusted downloads

Remove the quarantine attribute from a tool you control so Gatekeeper lets it run.

Terminal

xattr -d com.apple.quarantine ./downloaded-tool || true
./downloaded-tool --version

How to prevent it

Install into /usr/local or /opt, never SIP-protected system paths.
Strip quarantine from trusted CLI tools you download.
Prefer signed and notarized binaries to satisfy Gatekeeper.

Frequently asked questions

What causes ""Operation not permitted""?