launchd plist for rsync backup

I have an rsync2server script that works to completion when run from zsh.

Now I'm trying to make it run at night when my MacBook Air m2 2023 Ventura is sleeping.

First I created a plist to execute the script:

pat@Pats-MacBook-Air scripts % cat ~/Library/LaunchAgents/pat.rsync2server.plist 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>pat.rsync2server.plist</string>
    
    <key>StandardErrorPath</key>
    <string>/Users/pat/Documents/scripts/stderr.log</string>

    <key>StandardOutPath</key>
    <string>/Users/pat/Documents/scripts/stdout.log</string>
    
    <key>EnvironmentVariables</key>
    <dict>
        <key>PATH</key>
        <string><![CDATA[/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin]]></string>
    </dict>

    <key>ProgramArguments</key>
    <array>
        <string>/bin/sh</string>
        <string>-c</string>
        <string>/Users/pat/Documents/scripts/rsync2server.sh</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>10</integer>
        <key>Minute</key>
        <integer>55</integer>
    </dict>
</dict>
</plist>

Where the time is a couple minutes in the future so it will execute while I watch.

After it executes I get stderr.log:

pat@Pats-MacBook-Air scripts % cat stderr.log 
/bin/sh: /Users/pat/Documents/scripts/rsync2server.sh: Operation not permitted

If I execute from the terminal:

pat@Pats-MacBook-Air scripts % /bin/sh /Users/pat/Documents/scripts/rsync2server.sh

Everything works fine.

Do I have a path problem? I'm not familiar with the environment that ~/Library/LaunchAgent launchd and plist use when running.

I load the plist using the id for my gui user "pat".

pat@Pats-MacBook-Air scripts % sudo launchctl bootstrap gui/503  Users/pat/Library/LaunchAgents/pat.rsync2server.plist

Solution

The fix for "Operation not permitted" was to give /bin/sh permission to use the entire disk. AFAIK this is a macOS specific thing that you set in the system settings.

Go to System Settings app (Control Panel for older macOS)->Privacy & Security->Full Disk Access. You will see a panel with programs listed. The only way to get /bin/sh into that list is bring up a Finder window and pick the Go To Folder menu and type /bin/sh then drag the sh file into System Settings. Make sure the sh entry has the switch on for enabling access--et voila.

After this my plist worked.

Thanks to a responder on Reddit.