Vagrant: tee: /etc/exports: Operation not permitted on macOS 10.14 Mojave with nfs exports

[chregu]

On macOS 10.14 Mojave (official release from the app store) vagrant doesn't seem to be able to write to /etc/exports anymore while trying to make a NFS mount. root isn't allowed to do that anymore due to
System Integrity Protection. Disabling that permanently certainly isn't a solution, but helps to at least get back an /etc/exports file with all the needed entries.

Vagrant version

Vagrant 2.1.5

Host operating system

macOS 10.14 Mojave

Guest operating system

Linux, but doesn't matter, it fails bevore

Vagrantfile

Not important

Debug output

tee: /etc/exports: Operation not permitted
tee: /etc/exports: Operation not permitted
tee: /etc/exports: Operation not permitted

Expected behavior

It can write to /etc/exports

Actual behavior

It can't due to Mojave's apparently extended System Integrity Protection.

Steps to reproduce

1. Install maxOS 10.14 Mojave
2. vagrant up on a Vagrantfile with nfs mounts

References

https://groups.google.com/forum/#!topic/vagrant-up/iqyaZNpcyzM

[karlshea]

You also can't just create the file with SIP disabled and then re-enable it. The file with the correct entries is there, but when it tries to mount it you just get an error:

mount -o vers=3 192.168.88.1:/<path> /var/www
mount.nfs: requested NFS version or transport protocol is not supported

showmount also returns errors:

showmount: Cannot retrieve info from host: 192.168.88.1: RPC: Program not registered

[chregu]

Oh no, you're right. my /etc/exports was removed again, it's not there anymore at least... I guess some SIP process removed that again.. No idea how one is supposed to add exports to nfs nowadays.

[kamilgrzegorczyk]

I have same exact issue.

[chregu]

The only real - but hopefully only temporary - solution I know of right now is to switch to "VirtualBox Shared Folders" with removing the nfs entries in your Vagrantfile. At least, your boxes works then again, slower maybe, but they do work. Or rsync, but I didn't test that.

[kamilgrzegorczyk]

I made the same fix - reverted to "default" sync type in my puPHPet config.yaml
Obviously it won't be so performant as NFS but will do for now.

It looks like we have again issues with NFS popping up after new system release (there were plenty of issues with NFS after High Sierra upgade).

[briancain]

If rsync or virtualbox/vmware shared folders aren't an option, you can also use smb on macOS to sync folders as a temporary work around.

[karlshea]

So this is what I've discovered:

It's not actually SIP or rebooting that's deleting /etc/exports after it's been created, it's Vagrant restarting the ntpd service (maybe that call is also now wrong? the file is moved to /etc/exportsbak, and then /etc/exports doesn't exist anymore).

If /etc/exports contains the correct items, and you pass nfs_export: false to the config.vm.synced_folder method in the options array so Vagrant leaves it alone, everything works fine (it must be false for every synced folder).

I figured this out because NFS Manager is compatible with Mojave and can edit /etc/exports through its GUI interface. When I recreated the correct items (while SIP is enabled) in the GUI and then afterwards did a vagrant up everything just worked right away.

What the Vagrant developers might want to look into is how NFS Manager is doing its job. There's a helper utility that you have to grant permissions to that it installs at /Library/PrivilegedHelperTools/NFSManager-PrivilegedTool, and then you add it to System Preferences > Security & Privacy > Privacy > Full Disk Access. Afterwards you'll get a password prompt when it tries to write to the file, but it will succeed and nfsd picks up the settings.

I tried just adding the vagrant binary but that didn't work. I'm guessing it has to be the actual script executing the commands and I'm not sure exactly what that is.

[vuon9]

I've disabled SIP and it works. But I assumed that's just a temp solution https://support.accountek.com/support/solutions/articles/6000101816-odb-1-61d-install-disabling-sip-system-integrity-protection-on-mac-os-el-capitan-10-11-

Just note for normal users who have updated to the new version of macOS and got the same problem with Vagrant.

---

THIS IS A NOT-GOOD SOLUTION, please continue to scrolling and see more comments.

[ruudk]

Same issue here... It's weird that it works on my Macbook with latest public beta (GM) without issues. Just updated my iMac and that one doesn't work.

[hjemmesidekongen]

I can confirm that disabling SIP works. Thanks @vuongggggg

[JohnYeohMY]

Disabling SIP works for me too. Recommend everyone to do the same.

[chregu]

You really should NOT disable SUP permanently. There's a reason for it being there and even extended now:

Don’t do this unless you have a very good reason to do so and know exactly what you’re doing! Most users won’t need to disable this security setting. It’s not intended to prevent you from messing with the system — it’s intended to prevent malware and other badly behaved programs from messing with the system

(From https://www.howtogeek.com/230424/how-to-disable-system-integrity-protection-on-a-mac-and-why-you-shouldnt/ )

[ruudk]

This fixed it for me:
https://twitter.com/jordanpittman/status/1044374223664361473

Weird thing is, that my Macbook only needed it to be at Accessibility, and not Full Disk access.

[ruudk]

When doing vagrant up in the regular Mac Terminal app I get:

After clicking OK it works without issues.

I guess this issue is with iTerm2.

[chregu]

Great, adding Full Disk Access to iTerm did it for me too. That's the best approach yet, IMHO. iTerm should have Full Disk Access anyway, I assume :)

[dizballanze]

If you are using tmux, you should allow it as well.

[karlshea]

Omg I didn't even think of trying to just add iTerm.

[DrLongGhost]

Thanks to everyone for the info. I'll attempt to summarize for everyone (though I may get some specifics wrong):

• The Mojave upgrade removes/disables NFS, resulting the /etc/exports being renamed to /etc/exportsbak
• Instead of moving the file back, it is recommended to use the NFS Manager to recreate the share (Directions for this provided above and on their page)
• It is also necessary to go into OS-X settings and grant one of the NFS Manager's helper scripts and iTerm2 (or whatever terminal you use) full access to your file system. Again, directions are provided above.
• Once you've got these things set up, restart your terminal, reload the vagrant box and NFS should be working again.

[chregu]

Just the 3rd and 4th point seems to be enough. Vagrant will recreate/modify your exports file anyway

[42pe]

When doing vagrant up in the regular Mac Terminal app I get:

After clicking OK it works without issues.

I guess this issue is with iTerm2.

I get this but mine says "Alfred", which in turn is what started VSCode, which is where I start vagrant (with the terminal Window). I hit ok, and it works fine.

[karlshea]

Thanks to everyone for the info. I'll attempt to summarize for everyone (though I may get some specifics wrong)

All of that will work, but if I do none of that except give iTerm Full Disk Access then everything works as before.

[ahmedelgabri]

The Mojave upgrade removes/disables NFS, resulting the /etc/exports being renamed to /etc/exportsbak

That's not the case with a fresh install, I don't have /etc/exports or /etc/exportsbak files anywhere ~& I can't create one too.~

~Tried with sudo vi /etc/exports & sudo touch /etc/exports still didn't allow me to create the file~

Edit: a system restart fixed the creation part & now everything works fine.

[digitalbridge]

If you are using tmux, you should allow it as well.

How did you allow tmux? you cannot choose it from GUI.

[dizballanze]

If you are using tmux, you should allow it as well.

How did you allow tmux? you cannot choose it from GUI.

I created a symlink to /usr/local/bin where tmux binary is located on my machine:

ln -s /usr/local/bin /Users/.../localbin

After that you can choose it from GUI

[acodeninja]

If you are using tmux, you should allow it as well.

How did you allow tmux? you cannot choose it from GUI.

I created a symlink to /usr/local/bin where tmux binary is located on my machine:

ln -s /usr/local/bin /Users/.../localbin

After that you can choose it from GUI

No need to make any links, in recent versions of macOS you can view all hidden files using cmd + shift + .. In the finder window just cmd + up until you get to the root of the hard drive then dive down into /usr/local/bin.

[dmt0]

FYI: issue on iTerm2: https://gitlab.com/gnachman/iterm2/issues/7182

[mfn]

All of that will work, but if I do none of that except give iTerm Full Disk Access then everything works as before.

This is also my experience. Until I manually gave iTerm2 the full disk access, I could not get it working.

[lcharette]

When doing vagrant up in the regular Mac Terminal app I get:

After clicking OK it works without issues.

I guess this issue is with iTerm2.

I've got the same thing on iMac + MacBook Air. Adding Terminal (or whatever launch the vagrant up command, ie Vagrant Manager, VSCode...) to the "Full Disk Access" privacy settings like @ruudk suggested will get rid of this warning.

[xnt]

Just a heads up that another thing I had to do, in addition to @ruudk 's fabulous fix, was updating VirtualBox.

5.2.10 won't run (but you won't know it unless you try to boot up VirtualBox, not Vagrant). 5.2.18 does the trick. Not sure of which version inbetween is the magic one.

VirtualBox download link.

[aibolik]

@ruudk thank you much. That tweet fixed for me. Actually only Full Disk access is enough

[mager]

I love that everyone is using Dark Mode. Setting Full Disk Access on iTerm2 worked for me.

[Bonemeijer]

Fixed it for me too.
To help future Googlers, this is how you give iterm full disk access https://gitlab.com/gnachman/iterm2/wikis/fulldiskaccess

[ideal]

Add iTerm to "Full Disk Access" fix for me.
Thanks.

[alexposm]

Add iTerm to "Full Disk Access" fix for me.

The same,
Thanks

[munai-das]

+1 Adding Full Disk Access fixed it for me too.

[digitalwert-developer]

+1 for "Adding Full Disk Access" for iTerm.
Just beware: it seems like you'll have to remove and re-add "Full Disk Access" for iTerm after updating it

[soumyanjaleemahapatra]

If full disk access and/or granting accessibility permissions don't work, try upgrading VirtualBox and then Vagrant (if required)

[sluipmoord]

+1 Adding Full Disk Acces

[ruudk]

We all know the solution now. Can we please lock this issue? @mitchellh

[briancain]

Closing this since it seems like there is a solution for the issue.