1 Reply
      Latest reply on Apr 15, 2019 6:16 AM by aordway
      aordway Level 1 Level 1 (0 points)

        I have a file that can not be removed. When I attempt rm -f /Applications/CrashPlan.app I get "Operation not permitted"

         

        Here is the scenario, CrashPlan.app was installed on the MacBook Pro (MacBookPro14,2) running 10.14.4. I found out it was an older version of CrashPlan so I downloaded the installer for the new version and ran it. The installed failed and left behind a file of size 0K.

         

        -rw-r--r--@  1 root  admin    0 Apr 11 11:43 CrashPlan.app

         

        I then tried to remove the 0K file in terminal with sudo rm -f /Applications/CrashPlan.app and that failed with operation not permitted. I then booted into Recovery mode and ran csrutil disable from terminal and rebooted.

         

        sudo rm -f /Applications/CrashPlan.app still failed with operation not permitted.

         

        I ran csrutil status in terminal to make sure that sip was disabled and got back: System Integrity Protection status: disabled.

         

        I tried booting into single user mode and mounted the drive and tried to rm from there and got the same result. So, from single user mode I did the following:

        mv /Applications /ApplicationsOLD

        mkdir /Applications

        mv /ApplicationsOLD/* /Applications/

         

        and got an error "Operation not permitted" for CrashPlan.app

         

        rebooted and was able to install the new version of CrashPlan, but now I have a folder /ApplicationsOLD that I can not get rid of.

         

        Any ideas?

        • Re: rm results in "operation not permitted"
          aordway Level 1 Level 1 (0 points)

          I found the solution.

           

          Doing an ls -lO shows what flags were turned on. In this case the schg flag was on.

          ls -lOe CrashPlan.app

          -rw-r--r--@ 1 root  admin  schg 0 Apr 11 10:43 CrashPlan.app

           

          Executing "chflags -hv noschg CrashPlan.app" turned off the schg flag and allowed me to rm the file.