starting nix-shell on mac "Operation not permitted"

Question

I am building natively on intel Mac. After nix-build finished I run nix-shell and it ends with following error:

installing
Installing executable cardano-cli in /nix/store/qxzkl3pvmj1agri8a4k6awd4gsd61in2-cardano-cli-exe-cardano-cli-1.32.1/bin
Warning: The directory
/nix/store/qxzkl3pvmj1agri8a4k6awd4gsd61in2-cardano-cli-exe-cardano-cli-1.32.1/bin
is not in the system search path.
Setting gitrev of /nix/store/qxzkl3pvmj1agri8a4k6awd4gsd61in2-cardano-cli-exe-cardano-cli-1.32.1/bin/cardano-cli ... OK
"Bundling /nix/store/vv3k4s0gzkvdbirq5iiah15w920z6aql-zlib-1.2.11/lib/libz.dylib in /nix/store/qxzkl3pvmj1agri8a4k6awd4gsd61in2-cardano-cli-exe-cardano-cli-1.32.1/bin/cardano-cli"
error: getting status of '/nix/store/.links': Operation not permitted
rewrite-libs: ProcFailed {procCommand = "nix-store", procArguments = ["-r","/nix/store/vv3k4s0gzkvdbirq5iiah15w920z6aql-zlib-1.2.11/lib/libz.dylib"], procExitCode = ExitFailure 1}
builder for '/nix/store/z0i1gyl2blzxp2naan6wq3dib60r818r-cardano-cli-exe-cardano-cli-1.32.1.drv' failed with exit code 1
error: build of '/nix/store/87iqpvg6d4bizsgrzg35k8rc5m1x64ch-cardano-node-exe-cardano-node-1.32.1.drv', '/nix/store/b0q86i19kw66v5v8r21p1z8rs2mgm6dc-pre-commit-config.json.drv', '/nix/store/z0i1gyl2blzxp2naan6wq3dib60r818r-cardano-cli-exe-cardano-cli-1.32.1.drv' failed

I think it is related to "System Integrity Protection (SIP)" on mac - adding full disk access to terminal or nix-shell did not work - I am guessing that I need to give fll disk access permission to the actual build command but not sure what it is.

Answer 1

I was able to resolve this with the following nix.conf and a full restart of my M1 Mac. The key was setting sandbox to false and adding the last two lines.

build-users-group = nixbld
substituters        = https://hydra.iohk.io https://iohk.cachix.org https://cache.nixos.org/
trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= iohk.cachix.org-1:DpRUyj7h7V830dp/i6Nti+NEO2/nhblbov/8MW7Rqoo= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
sandbox = false
extra-sandbox-paths = /System/Library/Frameworks /System/Library/PrivateFrameworks /usr/lib /private/tmp /private/var/tmp /usr/bin/env
system = x86_64-darwin
extra-platforms = x86_64-darwin aarch64-darwin
experimental-features = nix-command
extra-experimental-features = flakes

A more detailed guide can be found here. cardano-plutus-apps-install-m1