For a couple of months, I have been running the 2.5.30 client on macOS 26 backing up to a 2.5.37 server on a Synology NAS on the same network. Since last week I get errors, probably related to the update to macOS 27.
Here is the relevant part from the client log:
2026-09-21 14:07:18: Snapshot mounted at /Volumes/urbackup_snaps/8c231c5e04081a60d2d485c6365c58cf238f74a0cd37268e
2026-09-21 14:07:18: Shadowcopy path: /Volumes/urbackup_snaps/8c231c5e04081a60d2d485c6365c58cf238f74a0cd37268e
2026-09-21 14:07:18: done.
2026-09-21 14:07:18: Removing deleted directories from index for "/"...
2026-09-21 14:07:18: Scanning for changed hard links on volume of "/"...
2026-09-21 14:07:18: Disabling CBT on volume ""
2026-09-21 14:07:18: Indexing "rootfs"...
2026-09-21 14:07:18: [macOS] Skipping "/home" due to macOS exclusion "/home*"
2026-09-21 14:07:18: [macOS] Skipping "/.fseventsd" due to macOS exclusion "/.fseventsd*"
2026-09-21 14:07:18: [macOS] Skipping "/.TemporaryItems" due to macOS exclusion "/.TemporaryItems*"
2026-09-21 14:07:18: [macOS] Skipping "/.Spotlight-V100" due to macOS exclusion "/.Spotlight-V100*"
2026-09-21 14:07:18: [macOS] Skipping "/.DocumentRevisions-V100" due to macOS exclusion "/.DocumentRevisions-V100*"
2026-09-21 14:07:26: ClientService cmd: #ICAz5w0TDgKbMXfYThv2l#2PING RUNNING pc_done=&eta_ms=1525172&status_id=166&speed_bpms=0&total_bytes=-1&done_bytes=0&paused_fb=1#token=2NFgdVAnAX5JQ7WUdDO3
2026-09-21 14:07:28: [macOS] Skipping "/Library/Updates" due to macOS exclusion "/Library/Updates*"
2026-09-21 14:07:28: [macOS] Skipping "/Library/Trial" due to macOS extended attribute exclusion
2026-09-21 14:07:28: [macOS] Skipping "/Library/Application Support/Apple/AssetCache/Data" due to macOS extended attribute exclusion
2026-09-21 14:07:29: ERROR: Cannot stat "/Volumes/urbackup_snaps/8c231c5e04081a60d2d485c6365c58cf238f74a0cd37268e/Library/Caches/com.apple.amsengagementd.classicdatavault": Operation not permitted (1)
2026-09-21 14:07:29: ERROR: Cannot stat "/Volumes/urbackup_snaps/8c231c5e04081a60d2d485c6365c58cf238f74a0cd37268e/Library/Caches/com.apple.aneuserd": Operation not permitted (1)
2026-09-21 14:07:29: ERROR: Cannot stat "/Volumes/urbackup_snaps/8c231c5e04081a60d2d485c6365c58cf238f74a0cd37268e/Library/Caches/com.apple.aned": Operation not permitted (1)
2026-09-21 14:07:29: ERROR: Error while listing files in folder "/Volumes/urbackup_snaps/8c231c5e04081a60d2d485c6365c58cf238f74a0cd37268e/Library/Caches". User may not have permissions to access this folder. Errno is 0
2026-09-21 14:07:29: Deleting shadowcopy for path "/Volumes/urbackup_snaps/8c231c5e04081a60d2d485c6365c58cf238f74a0cd37268e" -2
2026-09-21 14:07:29: Deleted local snapshot '2026-09-21-140716'
2026-09-21 14:07:29: Deleting Shadowcopy for dir "/"
I searched for other files that run into Operation not permitted when ls’ed by root (sudo ls -alR / 2>&1 | grep permitted). There are more residing in these directories or subdirectories thereof:
In fact, should it even be necessary to exclude this as “/Library/Caches/*” is by default excluded in line 5167 of urbackupclient/client.cpp?
And shouldn’t line 133 of urbackupcommon/os_functions_lin.cpp produce a “Skipping due to macOS SIP restriction” log entry for “/Library/Caches/com.apple.aned”?
In addition to the files listed in these two places I see a couple of other files or directories on my system that I cannot stat:
OK, I figured this one out. I copied the apfs_snapshot scripts from the macOS pkg and now it creates a shadow copy. But now I’m back at the /Volumes/urbackup_snaps/… errors. Apparently, because the newly added exceptions only apply to / and not to the snapshot. How can I fix this?
The list stops working on the snapshot because it compares the full path. In the snapshot every path starts with /Volumes/urbackup_snaps//, so /Library/Caches/… never matches. Excluding the folders doesn’t help either, because the lstat that fails runs before excludes are applied.
Instead of extending the list, you could skip anything lstat refuses with “Operation not permitted” (EPERM, the “(1)” in your log lines). In urbackupcommon/os_functions_lin.cpp, in getFiles(), at the start of the else branch after lstat64 fails, right after int err = os_last_error(errmsg);:
This works for / and for the snapshot, and it also covers whatever the next macOS update locks down. One downside: if Full Disk Access ever gets lost, files would be skipped with an info line instead of an error, so check the log for those lines now and then.
On your other points:
The “-R419…” suffix is your Mac’s serial number. Without an explicit computer name, the macOS client names itself “Computer Name-Serial” (it has done that since 2017) and caches the suffix in var/urbackup/mac_computername_add.txt. To get rid of it, set the computer name in the tray menu under Settings → Client, or with urbackupclientctl set-settings -k computername -v Macncheese. If the client keeps the same identity, the server should rename the existing entry and keep its backups.
Missing .ico files: the source tarball only ships the .xpm icons, but the macOS branch of the Makefile installs .ico files, which only exist in the urbackup_frontend_wx git repo. So your workaround is fine; it’s a packaging gap in the tarball.
Shadow copy: right, the APFS snapshot scripts aren’t in the public source. They only come with the pkg, so copying them over is the way to go.
I don’t have a Mac to test this on. Could you post whether the backup then finishes without errors?
And one more thing I don’t understand: without the snapshot I had to add all the entries above to the exclusion list, with the snapshot the EPERM error only pops up for the following
2026-10-16 10:13:55: [macOS] Skipping "/Volumes/urbackup_snaps/xxx/Library/Caches/com.apple.amsengagementd.classicdatavault": Operation not permitted (probably SIP)
2026-10-16 10:13:55: [macOS] Skipping "/Volumes/urbackup_snaps/xxx/Library/Caches/com.apple.aneuserd": Operation not permitted (probably SIP)
2026-10-16 10:13:55: [macOS] Skipping "/Volumes/urbackup_snaps/xxx/Library/Caches/com.apple.aned": Operation not permitted (probably SIP)
2026-10-16 10:14:15: [macOS] Skipping "/Volumes/urbackup_snaps/xxx/private/var/db/ConfigurationProfiles/Store": Operation not permitted (probably SIP)
2026-10-16 10:14:15: [macOS] Skipping "/Volumes/urbackup_snaps/xxx/private/var/db/CoreDuet/Knowledge": Operation not permitted (probably SIP)
2026-10-16 10:14:15: [macOS] Skipping "/Volumes/urbackup_snaps/xxx/private/var/db/ExtensibleSSO/Configuration": Operation not permitted (probably SIP)
2026-10-16 10:14:16: [macOS] Skipping "/Volumes/urbackup_snaps/xxx/private/var/db/rmd/secure": Operation not permitted (probably SIP)
Options 2 and 3 can be combined, and that also fixes the speed concern: the list is only checked after lstat fails with EPERM, so normal files cost nothing extra. On a failure, cut the snapshot mount prefix off the path and compare the rest with the existing SIP list. Real errors still show up, and it works for both / and the snapshot. It still needs updating when Apple locks down more paths, but you’d notice that right away as an error.
On the shorter list with the snapshot: my guess is that macOS enforces part of the protection by path on the live system, and those rules don’t match under /Volumes/urbackup_snaps/. Other entries carry a “restricted” flag in the file system, which is copied into the snapshot. ls -lO on one of the 7 paths and on one of the paths that only fails on / should show the difference.
Which fix goes upstream is uroni’s decision. If you’d like to make it a PR against 2.6.x, that would be the easiest way to get it decided.
I haven’t tried it on macOS 27. If it fails, post the first error. The SIP list is in urbackupcommon/os_functions_lin.cpp on that branch too. For the PR: fork the repository, make a branch from 2.6.x, and choose 2.6.x as the base when you open the pull request.
That was faster than expected. ./create_osx_installer.sh -d works under macOS 27. Produced a bunch of warnings but no errors. I haven’t tried the pkg yet as I have a full backup running and will wait for that to finish.
pkgbuild has some issues:
pkgbuild: Inferring bundle components from contents of osx-pkg
write: Permission denied
write: Permission denied
write: Permission denied
write: Permission denied
pkgbuild: Wrote package to pkg1/output.pkg
pkgbuild: Inferring bundle components from contents of osx-pkg2/Applications/UrBackup Client.app
pkgbuild: Adding top-level preinstall script
pkgbuild: Adding top-level postinstall script
write: Permission denied
write: Permission denied
write: Permission denied
write: Permission denied
pkgbuild: Wrote package to pkg1/output2.pkg
Obviously, the same happens on 2.5.30. I haven’t figured out how to tell pkgutil to be more specific. But so far I see no ill effects from the Permission denied.
