1435 - ESE error on macOS: "Operation not permitted"

Modified on Tue, 5 Aug at 1:17 PM

Symptom

As part of installing ESE on macOS, you will have allowed the ESE agent full disk access permission. Failing to do this may result in errors. However, in some cases you may see "Operation not permitted" errors even with full disk access enabled.

Example:

ERROR : 19:02:17 Skipping: /System/Volumes/Data/private/var/db/searchparty (/System/Volumes/Data/private/var/db/searchparty: 
Operation not permitted)

Cause

The files that are being skipped are non-essential and are supposed to be excluded by the system, but in some versions of macOS (e.g. Catalina), the relevant exclusion filter is not present.

Solution

Manually exclude the affected directories containing the files referred to in the errors. These may include:

/System/Volumes/Data/private/var/db/ConfigurationProfiles/Store
/System/Volumes/Data/private/var/db/CoreDuet/Knowledge
System/Volumes/Data/private/var/db/fpsd/dvp
/System/Volumes/Data/private/var/db/lockdown
/System/Volumes/Data/private/var/db/searchparty
/System/Volumes/Data/private/var/folders/43/dyzr21151977ztm3954fb3700000gn/0/com.apple.SharedWebCredentials
/System/Volumes/Data/private/var/folders/43/dyzr21151977ztm3954fb3700000gn/0/SafariFamily