rm results in "operation not permitted"

Question

aordway OP

Created Apr ’19

Replies 6

Boosts 1

Views 13k

Participants 10

I have a file that can not be removed. When I attempt rm -f /Applications/CrashPlan.app I get "Operation not permitted"

Here is the scenario, CrashPlan.app was installed on the MacBook Pro (MacBookPro14,2) running 10.14.4. I found out it was an older version of CrashPlan so I downloaded the installer for the new version and ran it. The installed failed and left behind a file of size 0K.

-rw-r--r--@ 1 root admin 0 Apr 11 11:43 CrashPlan.app

I then tried to remove the 0K file in terminal with sudo rm -f /Applications/CrashPlan.app and that failed with operation not permitted. I then booted into Recovery mode and ran csrutil disable from terminal and rebooted.

sudo rm -f /Applications/CrashPlan.app still failed with operation not permitted.

I ran csrutil status in terminal to make sure that sip was disabled and got back: System Integrity Protection status: disabled.

I tried booting into single user mode and mounted the drive and tried to rm from there and got the same result. So, from single user mode I did the following:

mv /Applications /ApplicationsOLD

mkdir /Applications

mv /ApplicationsOLD/* /Applications/

and got an error "Operation not permitted" for CrashPlan.app

rebooted and was able to install the new version of CrashPlan, but now I have a folder /ApplicationsOLD that I can not get rid of.

Any ideas?

Boost

Answer 1

aordway OP

Apr ’19

I found the solution.

Doing an ls -lO shows what flags were turned on. In this case the schg flag was on.

ls -lOe CrashPlan.app

-rw-r--r--@ 1 root admin schg 0 Apr 11 10:43 CrashPlan.app

Executing "chflags -hv noschg CrashPlan.app" turned off the schg flag and allowed me to rm the file.

4

Answer 2

mr_mcgoo OP

Jan ’22

Adding some extra detail to aordway's answer - I had similar issues with FortiClient.app and FortiClientUninstaller.app

To remove the files that just would not go with any other method, I did the following in terminal;

cd /Applications
sudo chflags -hv noschg FortiClient.app
rm -R FortiClient.app

7

Answer 3

doctordj OP

May ’23

I'm just going to add my thanks to @aordway and @mr_mcgoo

sudo chflags noschg

is NOT documented in the man pages. Thanks for helping out.

Crashplan/Code42 also my nemesis here. What were they thinking? It's taken me about 2 hours to find this page!

0

Answer 4

DTS Engineer OP

Apple

May ’23

sudo chflags noschg is NOT documented in the man pages.

Hmmm, it is in my man page:

… The following keywords are currently defined:

    …

    schg, schange, simmutable
        set the system immutable flag (super-user only)

    …

Putting the letters “no” before or removing the letters “no” from a
keyword causes the flag to be cleared.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 5

omeran OP

Mar ’24

None of the above solutions worked for me. Is there any other way to be able to remove the file with "Operation not permitted" error?

$ ls -lOe X11 
lrwxr-xr-x  1 omeran  staff  restricted    8B Mar 24  2017 X11 -> /opt/X11
$ sudo chflags -hv noschg X11 
$ 
$ sudo rm -rf X11
rm: X11: Operation not permitted

0

Answer 6

richeney OP

Sep ’24

Slightly different issue for me as I had uchg flag set, but I had to remove it from both the file and the parent directory in order to delete the file. I then added the flag back on to the parent directory.

0