Permission Error 'operation not permitted' when moving files to /tardisks on ESXi when UEFI secure boot is enabled on BIOS

Products

• VMware NSX
• VMware vSphere ESXi

Issue/Introduction

When attempting to move or rename or copy a file (e.g., curl_wrapper.tar) to the /tardisks/ directory on an ESXi host using the mv command, the operation fails with the following error:

mv: can't rename 'filename'; operation not permitted

Environment

VMware vSphere ESXi

VMware NSX

Cause

This issue occurs because UEFI Secure Boot is enabled on the ESXi host. When Secure Boot is active, ESXi enforces strict security policies that prevent the root user from directly modifying or moving files into the /tardisks/ location to maintain system integrity.

Resolution

There are two primary methods to resolve this issue depending on your security requirements:

Method 1: Use a VIB (Recommended for Production)

Instead of moving files manually, package the file into a vSphere Installation Bundle (VIB) and install it on the ESXi host. This ensures the file is digitally signed and compliant with Secure Boot requirements.

Method 2: Disable UEFI Secure Boot (Workaround)

If you must perform manual move or copy operations to /tardisks/, you can temporarily disable Secure Boot.

1. Reboot the ESXi host and enter the BIOS/UEFI Setup.
2. Locate the Security or Boot settings.
3. Disable UEFI Secure Boot.
4. Save changes and reboot into ESXi.
5. Perform the mv or cp operation again to /tardisk.

Note: Disabling Secure Boot may impact the security posture of your host. It is recommended to re-enable it after the necessary operations are complete if VIB installation is not feasible.