1 Reply
      Latest reply on Apr 15, 2019 6:16 AM by aordway
      aordway Level 1 Level 1 (0 points)

        I have a file that can not be removed. When I attempt rm -f /Applications/CrashPlan.app I get "Operation not permitted"


        Here is the scenario, CrashPlan.app was installed on the MacBook Pro (MacBookPro14,2) running 10.14.4. I found out it was an older version of CrashPlan so I downloaded the installer for the new version and ran it. The installed failed and left behind a file of size 0K.


        -rw-r--r--@  1 root  admin    0 Apr 11 11:43 CrashPlan.app


        I then tried to remove the 0K file in terminal with sudo rm -f /Applications/CrashPlan.app and that failed with operation not permitted. I then booted into Recovery mode and ran csrutil disable from terminal and rebooted.


        sudo rm -f /Applications/CrashPlan.app still failed with operation not permitted.


        I ran csrutil status in terminal to make sure that sip was disabled and got back: System Integrity Protection status: disabled.


        I tried booting into single user mode and mounted the drive and tried to rm from there and got the same result. So, from single user mode I did the following:

        mv /Applications /ApplicationsOLD

        mkdir /Applications

        mv /ApplicationsOLD/* /Applications/


        and got an error "Operation not permitted" for CrashPlan.app


        rebooted and was able to install the new version of CrashPlan, but now I have a folder /ApplicationsOLD that I can not get rid of.


        Any ideas?

        • Re: rm results in "operation not permitted"
          aordway Level 1 Level 1 (0 points)

          I found the solution.


          Doing an ls -lO shows what flags were turned on. In this case the schg flag was on.

          ls -lOe CrashPlan.app

          -rw-r--r--@ 1 root  admin  schg 0 Apr 11 10:43 CrashPlan.app


          Executing "chflags -hv noschg CrashPlan.app" turned off the schg flag and allowed me to rm the file.