Here’s a mystery. First, I can’t open a specific file on my Mac, even though I have read permission:

$ cd Downloads
$ ls -l "WhatsApp Video 2024-05-02 at 15.06.16.mp4"
-rw-r--r--@ 1 smith staff  16807637 May  2 15:19 WhatsApp Video 2024-05-02 at 15.06.16.mp4

$ file "WhatsApp Video 2024-05-02 at 15.06.16.mp4"
WhatsApp Video 2024-05-02 at 15.06.16.mp4: cannot open: Operation not permitted

I can read it with sudo…

$ sudo file "WhatsApp Video 2024-05-02 at 15.06.16.mp4"
Password:
WhatsApp Video 2024-05-02 at 15.06.16.mp4: ISO Media, MP4 v2 [ISO 14496-14]

…but then comes the strange part. After executing the previous command, the file remains readable by me without sudo:

$ file "WhatsApp Video 2024-05-02 at 15.06.16.mp4"
WhatsApp Video 2024-05-02 at 15.06.16.mp4: ISO Media, MP4 v2 [ISO 14496-14]

The file remains readable by me for some time afterward, even after I log out and log back in. Sometime in the next 24 hours, however, it becomes unreadable again. What’s going on here?

I noticed this problem because my system backup (with rsync) complained about “operation not permitted.”

In case it helps, here is the output of xattr, but this output looks the same as many other files in the same folder that are perfectly readable.

$ xattr -l "WhatsApp Video 2024-05-02 at 15.06.16.mp4"
com.apple.macl: 
com.apple.provenance: 
com.apple.quarantine: 0087;6633e72d;WhatsApp;