Cannot write to subfolder inside app content folder

[ALYB]

I have a macro that worked fine on Big Sur. Now I'm on Sonoma and the macro doesn't work anymore: I cannot write to a subfolder inside a (Java) app.

Here is the action:

I have made this folder and its content Read and Write:

But I stil get this error:

When I use the Open File action, I can open the res file with BBEdit.

The problem must be in the To part, since I can copy to the Desktop:

Please help.

[Airy]

You may get a longer/clearer error message if you open the KM Engine Log file. This is available by using the KM Editor and clicking on Help / Open Logs folder.

[peternlewis]

Sounds like a security limitation.

You might be able to work around it with things like something like: keep a copy of the entire app elsewhere, and copy it in to there, and then copy the entire thing to the Applications folder.

[ALYB]

This is from the log:

2023-11-22 10:53:47 Running application query took a while (19881 us)
2023-11-22 10:53:53 Execute macro “Create CT project files for new end client (DE)” from trigger The Status Menu is selected
2023-11-22 10:53:55 Action 2517 failed: Search and Replace action failed to set result with error Write File failed to write file to /Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/F-J/2_hama_de_nt.res with error Error Domain=NSCocoaErrorDomain Code=513 "“2_hama_de_nt.res” couldn’t be moved because you don’t have permission to access “F-J”." UserInfo={NSSourceFilePathErrorKey=/var/folders/d1/h3ckmyy92q5bmj_8k77p9hxc0000gr/T/TemporaryItems/NSIRD_Keyboard Maestro Engine_ZqJyy4/2_hama_de_nt.res, NSUserStringVariant=(
    Move
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/F-J/2_hama_de_nt.res, NSFilePath=/var/folders/d1/h3ckmyy92q5bmj_8k77p9hxc0000gr/T/TemporaryItems/NSIRD_Keyboard Maestro Engine_ZqJyy4/2_hama_de_nt.res, NSUnderlyingError=0x600017710ae0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}
2023-11-22 10:53:55 Action 2520 failed: Search and Replace action failed to set result with error Write File failed to write file to /Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/QA/F-J/0_hama_de_qa.res with error Error Domain=NSCocoaErrorDomain Code=513 "“0_hama_de_qa.res” couldn’t be moved because you don’t have permission to access “F-J”." UserInfo={NSSourceFilePathErrorKey=/var/folders/d1/h3ckmyy92q5bmj_8k77p9hxc0000gr/T/TemporaryItems/NSIRD_Keyboard Maestro Engine_oDKZav/0_hama_de_qa.res, NSUserStringVariant=(
    Move
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/QA/F-J/0_hama_de_qa.res, NSFilePath=/var/folders/d1/h3ckmyy92q5bmj_8k77p9hxc0000gr/T/TemporaryItems/NSIRD_Keyboard Maestro Engine_oDKZav/0_hama_de_qa.res, NSUnderlyingError=0x600017372250 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}
2023-11-22 10:53:56 Execute macro “Reveal Downloaded Files” from trigger Anything is added to folder “~/Dropbox/CT/User/CT_tpl” (immediately)
2023-11-22 10:54:14 Execute macro “Open Newest Project Folder” from trigger The Status Menu is selected

Can I solve this?
Would it be solved if I upgrade from Keyboard Maestro 10 to 11?

[griffman]

Does it work if you try to copy the file to that spot in Finder?

-rob.

[ALYB]

Well, I use CRAX Commander and that works.

The macro also works on my backup iMac with Big Sur.

[griffman]

Yes, we know it works on Big Sur. Sonoma changed a lot regarding file security in /Applications, which is why I asked what happens if you try in Finder? I don't know how CRAX Commander operates, and it doesn't help resolve the question, as it's another third-party tool. So does it work Finder?

-rob.

[ALYB]

It works in Finder.

Hans

[peternlewis]

@ALYB

Can I solve this?

Try using the mv shell command.

@ALYB

Would it be solved if I upgrade from Keyboard Maestro 10 to 11?

I very much doubt it.

This is the system refusing to do what you asked with the error Operation not permitted and couldn’t be moved because you don’t have permission to access “F-J”.

Note that is says you cannot access “F-J” and that is not actually in your action which makes me wonder what on earth is actually going on with your source and destination locations.

It is also complaining about the Search and Replace action not the Copy File action, so I am not sure you really understand what is actually going wrong…

[griffman]

Peter makes a good point: The error message in the log has nothing to do with the copy to your Desktop. It's erroring when trying to put something inside the application bundle. Is there another step in your macro that tries to modify the application bundle itself?

-rob.

[ALYB]

I think this all is over my head. Perhaps it's better if I try to work around this, e.g. by creating the RES files on the Desktop and then manually copying them into the app.

For the record I include the full macro. It indeed includes other copy actions to the app.
Create CT project files for new end client (DE).kmmacros (21.5 KB)

[griffman]

Thanks for the macro, that helps. And now, my test still stands, just with a different task :). In Finder, can you copy a file to the location shown in this action?

If not, then that's the new macOS Sonoma security model, and the only way around it would be to install the application somewhere outside the /Applications folder—many apps will work outside of /Applications, and then you should be able to write to it, I believe.

-rob.

[ALYB]

I placed 0_dummy.txt on the Desktop, copied it with Cmd+C, and pasted it successfully in the respective folder.

[griffman]

Then I'd recommend having the macro work that way: Instead of modifying the var and writing it directly to the file, write it first to a file on the desktop (or in /tmp or wherever) with the right name, then copy that file from the desktop into the app in another action (and finally delete the original file).

Based on your test, it seems that should work fine.

-rob.

[ALYB]

Okay, I'll try that. Thanks for your patience and help, Rob.

Cheers,

Hans

[ALYB]

I'm trying to get this macro to work and did exactly as you described. However, to no avail. So I started again, with only this basic action:

The TO field contains:

/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/U-Z

Firstly, I didn't change the Read and Write rights. Then I changed them to Read & Write for all users. Here's the log file:

2023-12-10 11:34:10 Running application query took a while (3402 us)
2023-12-10 11:36:02 Action 15066829 failed: Copy file /Users/hl/Desktop/wismij.txt failed with Error Domain=NSCocoaErrorDomain Code=513 "“wismij.txt” couldn’t be copied because you don’t have permission to access “U-Z”." UserInfo={NSSourceFilePathErrorKey=/Users/hl/Desktop/wismij.txt, NSUserStringVariant=(
    Copy
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/U-Z/wismij.txt, NSFilePath=/Users/hl/Desktop/wismij.txt, NSUnderlyingError=0x600002312ee0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}
2023-12-10 11:36:02 Copy file /Users/hl/Desktop/wismij.txt failed with Error Domain=NSCocoaErrorDomain Code=513 "“wismij.txt” couldn’t be copied because you don’t have permission to access “U-Z”." UserInfo={NSSourceFilePathErrorKey=/Users/hl/Desktop/wismij.txt, NSUserStringVariant=(
    Copy
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/U-Z/wismij.txt, NSFilePath=/Users/hl/Desktop/wismij.txt, NSUnderlyingError=0x600002312ee0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}} in macro “Trying” (while executing Copy File “~/Desktop/wismij.txt”).
2023-12-10 11:36:02 Action 15066829 failed: Copy file /Users/hl/Desktop/wismij.txt failed with Error Domain=NSCocoaErrorDomain Code=513 "“wismij.txt” couldn’t be copied because you don’t have permission to access “U-Z”." UserInfo={NSSourceFilePathErrorKey=/Users/hl/Desktop/wismij.txt, NSUserStringVariant=(
    Copy
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/U-Z/wismij.txt, NSFilePath=/Users/hl/Desktop/wismij.txt, NSUnderlyingError=0x600002312ee0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}
2023-12-10 11:36:02 Copy file /Users/hl/Desktop/wismij.txt failed with Error Domain=NSCocoaErrorDomain Code=513 "“wismij.txt” couldn’t be copied because you don’t have permission to access “U-Z”." UserInfo={NSSourceFilePathErrorKey=/Users/hl/Desktop/wismij.txt, NSUserStringVariant=(
    Copy
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/U-Z/wismij.txt, NSFilePath=/Users/hl/Desktop/wismij.txt, NSUnderlyingError=0x600002312ee0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}} in macro “Trying” (while executing Copy File “~/Desktop/wismij.txt”).
2023-12-10 11:37:56 Action 15066829 failed: Copy file /Users/hl/Desktop/wismij.txt failed with Error Domain=NSCocoaErrorDomain Code=513 "“wismij.txt” couldn’t be copied because you don’t have permission to access “U-Z”." UserInfo={NSSourceFilePathErrorKey=/Users/hl/Desktop/wismij.txt, NSUserStringVariant=(
    Copy
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/U-Z/wismij.txt, NSFilePath=/Users/hl/Desktop/wismij.txt, NSUnderlyingError=0x60000234e400 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}
2023-12-10 11:37:56 Copy file /Users/hl/Desktop/wismij.txt failed with Error Domain=NSCocoaErrorDomain Code=513 "“wismij.txt” couldn’t be copied because you don’t have permission to access “U-Z”." UserInfo={NSSourceFilePathErrorKey=/Users/hl/Desktop/wismij.txt, NSUserStringVariant=(
    Copy
), NSDestinationFilePath=/Applications/CafeTran.app/Contents/app/infos/resources/Glossaries/NT/U-Z/wismij.txt, NSFilePath=/Users/hl/Desktop/wismij.txt, NSUnderlyingError=0x60000234e400 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}} in macro “Trying” (while executing Copy File “~/Desktop/wismij.txt”).
2023-12-10 11:41:14 Execute macro “Open BBEdit” from trigger The Hot Key ⌘F2 is pressed
2023-12-10 11:41:14 Running application query took a while (3892 us)

How should I proceed now?

I don't understand this:

"“wismij.txt” couldn’t be copied because you don’t have permission to access “U-Z”." 

Did some more testing in the Terminal:

The copying isn't possible here either:

Something like this does work:

[griffman]

It seems like there must be some sort of OS-level protection on modifying that folder via anything other than direct user involvement—possibly to mitigate against scripted attacks? This is only conjecture, based on your experimental results. The "automatic" methods (copying the file in either KM or Terminal) failed, but the manual methods (dragging a file in Finder or navigating the UI) worked.

One last thought, do KM and KM Engine have full disk access rights in System Settings > Privacy & Security > Full Disk Access? If not, you might try adding them there and seeing if it then works.

-rob.

[ALYB]

The full disk access was set.

Meanwhile, I have decided to solve it via two symlinks. The new glossary resource definition files are created in ~/Dropbox/Glossaries and the symlinks point to the subfolder in the CafeTran Espresso app. That works.