mac catalina tar errors on launchctl but not when running script from terminal

Question

I am getting an error when taring my Desktop folder using launchctl.

EDIT: This error only occurs on certain folders, (i.e. Desktop). It works fine on other folders (i.e. /etc). The test.sh script below only runs the tar command on the Desktop. My backup, where the REAL problem is, tars many different directories. It also appears to have started after the upgrade to Catalina OS.

tar: Could not pack extended attributes: Operation not permitted
tar: Removing leading '/' from member names a Users/davidk/Desktop
tar: /Users/davidk/Desktop: Couldn't visit directory: Unknown error: -1
tar: Error exit delayed from previous errors.

I assume is has to do with security. I have tried giving full disk access to launchctl and bsdtar, but still get the error.

My plist:

more /Library/LaunchDaemons/test.plist 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>test</string>
        <key>ProgramArguments</key>
        <array>
                <string>/etc/cron.daily/test.sh</string>
        </array>
        <key>StandardOutPath</key>
        <string>/var/log/test.log</string>
        <key>StandardErrorPath</key>
        <string>/var/log/test.log</string>

        <key>StartCalendarInterval</key>
        <dict>
                <key>Hour</key>
                <integer>1</integer>
                <key>Minute</key>
                <integer>1</integer>
        </dict>
        <key>ProcessType</key>
        <string>Background</string>
</dict>
</plist>

[davids-imac:cron.daily root]$ launchctl start test

results:

backup.sh begin '11/07/2019 12:10:00'
Script executed from: /
Script location BASEDIR: /etc/cron.daily
running DAILY
 192.168.1.225:/home/backup/davids-imac.dkcc.com/Thu/  -> Should be  192.168.1.225:/home/backup/davids-imac.dkcc.com/Thu
end tests
Running! '11/07/2019 12:10:00'
12:10:00 rm /usr/local/backup/davidk-Desktop.tar.gz
12:10:00  tar /davidk/Desktop..
tar: Could not pack extended attributes: Operation not permitted
tar: Removing leading '/' from member names
a Users/davidk/Desktop
tar: /Users/davidk/Desktop: Couldn't visit directory: Unknown error: -1
tar: Error exit delayed from previous errors.
12:10:00  

and the tar file is:

-rw-r--r--  1 root  wheel         127 Nov  7 12:10 davidk-Desktop.tar.gz

but when running from terminal:

[davids-imac:cron.daily root]$ ./test.sh 
backup.sh begin '11/07/2019 12:23:46'
Script executed from: /etc/cron.daily
Script location BASEDIR: .
running DAILY
 192.168.1.225:/home/backup/davids-imac.dkcc.com/Thu/  -> Should be  192.168.1.225:/home/backup/davids-imac.dkcc.com/Thu
end tests
Running! '11/07/2019 12:23:46'
12:23:46 rm /usr/local/backup/davidk-Desktop.tar.gz
12:23:46  tar /davidk/Desktop..
tar: Removing leading '/' from member names
12:26:17  
12:26:17  removing PID
12:26:17  Complete!
Began: '11/07/2019 12:23:46', Completed: 12:26:17

and the tar file is:

-rw-r--r--  1 root  wheel  5059085737 Nov  7 12:26 davidk-Desktop.tar.gz

EDIT: Added test.sh -- This is a simplified backup, but isolated the problem to tar command:

[davids-imac:cron.daily root]$ more test.sh 
#!/bin/bash

START_TIME=`date +"'%m/%d/%Y %H:%M:%S'"`
PIDFILE=/var/run/dkccBackup.pid
BKUPFILE=/etc/backup/bkup.sh
LOCAL_DIR=/usr/local/backup
MONTHLY_IP=192.168.1.230
DAILY_IP=192.168.1.225
RUN_IP=" "
MDATE=" "
HOSTNAME=`hostname`

echo "backup.sh begin ${START_TIME}"
echo "Script executed from: ${PWD}"

BASEDIR=$(dirname $0)
echo "Script location BASEDIR: ${BASEDIR}"
if [ "${BASEDIR}" == "/etc/cron.daily" ] || [ "${PWD}" == "/etc/cron.daily" ]; then
   echo "running DAILY"
   RUN_IP="$DAILY_IP"
   MDATE=`date +%a`
elif [ "${BASEDIR}" == "/etc/cron.monthly" ] || [ "${PWD}" == "/etc/cron.monthly" ]; then
        echo "running MONTHLY"
   RUN_IP="$MONTHLY_IP"
   MDATE=`date +%B`
else 
        echo "Cannot determine Monthly or daily, assuming daily"
   RUN_IP="$DAILY_IP"
   MDATE=`date +%a`
fi

BACKUP_DIR="${RUN_IP}:/home/backup/${HOSTNAME}/${MDATE}"
echo " $RUN_IP:/home/backup/`hostname`/`date +%a`/  -> Should be  $BACKUP_DIR"

echo end tests

timeout=6  # timeout after 60mn  
while ((timeout > 0)) && [ -f $PIDFILE ];
do
        echo Sleeping 10 minutes `date +"'%m/%d/%Y %H:%M:%S'"` 

   sleep 1000
   ((timeout -= 1))
done 

echo Running! `date +"'%m/%d/%Y %H:%M:%S'"` 
touch $PIDFILE


echo `date +"%T"` rm $LOCAL_DIR/davidk-Desktop.tar.gz
rm -f $LOCAL_DIR/davidk-Desktop.tar.gz

echo `date +"%T"` " tar /davidk/Desktop.."
/usr/bin/tar --no-xattr -zcf $LOCAL_DIR/davidk-Desktop.tar.gz /Users/davidk/Desktop

echo `date +"%T"` " "

echo `date +"%T"` " removing PID"
rm -f $PIDFILE

echo `date +"%T"` " Complete!"
echo "Began: ${START_TIME}, Completed: `date +"%T"`"

Answer 1

I figured it out. It was security.

I needed to give full disk access to /bin/bash.

System Preferences -> Security and Privacy

Under the Privacy tab, scroll down to "Full Disk Access"

Click the lock and enter your password.

Open a new finder window and go to /bin folder.

Drag the bash icon into the "Allow the apps below to access data" area, and the tar is now working.

Earlier I had dragged bsdtar, launchctl, terminal to allow disk access as well.