rm results in "operation not permitted"

I have a file that can not be removed. When I attempt rm -f /Applications/CrashPlan.app I get "Operation not permitted"


Here is the scenario, CrashPlan.app was installed on the MacBook Pro (MacBookPro14,2) running 10.14.4. I found out it was an older version of CrashPlan so I downloaded the installer for the new version and ran it. The installed failed and left behind a file of size 0K.


-rw-r--r--@ 1 root admin 0 Apr 11 11:43 CrashPlan.app


I then tried to remove the 0K file in terminal with sudo rm -f /Applications/CrashPlan.app and that failed with operation not permitted. I then booted into Recovery mode and ran csrutil disable from terminal and rebooted.


sudo rm -f /Applications/CrashPlan.app still failed with operation not permitted.


I ran csrutil status in terminal to make sure that sip was disabled and got back: System Integrity Protection status: disabled.


I tried booting into single user mode and mounted the drive and tried to rm from there and got the same result. So, from single user mode I did the following:

mv /Applications /ApplicationsOLD

mkdir /Applications

mv /ApplicationsOLD/* /Applications/


and got an error "Operation not permitted" for CrashPlan.app


rebooted and was able to install the new version of CrashPlan, but now I have a folder /ApplicationsOLD that I can not get rid of.


Any ideas?

Post not yet marked as solved Up vote post of aordway Down vote post of aordway
12k views
Posted by
aordway
Reply
Add a Comment

Replies

I found the solution.


Doing an ls -lO shows what flags were turned on. In this case the schg flag was on.

ls -lOe CrashPlan.app

-rw-r--r--@ 1 root admin schg 0 Apr 11 10:43 CrashPlan.app


Executing "chflags -hv noschg CrashPlan.app" turned off the schg flag and allowed me to rm the file.

Posted by
aordway
Post not yet marked as solved Up vote reply of aordway Down vote reply of aordway
Add a Comment

Adding some extra detail to aordway's answer - I had similar issues with FortiClient.app and FortiClientUninstaller.app

To remove the files that just would not go with any other method, I did the following in terminal;

cd /Applications
sudo chflags -hv noschg FortiClient.app
rm -R FortiClient.app
Posted by
mr_mcgoo
Post not yet marked as solved Up vote reply of mr_mcgoo Down vote reply of mr_mcgoo

  • thank you veryy much I finally deleted this forticlient

    —
    BBchap

  • Could you help me please? I still can't change flags on FortiClient.app by chflags. It shows: chflags: FortiClient.app: Operation not permitted

    —
    The_Webster

  • @aordway I've faced same problem with FortiClient.app on M2 Application is locked and I can't change flags to noschg and then delete the FortiClient.app Could you tell me please, how did you solve this problem?

    —
    The_Webster
Add a Comment

I'm just going to add my thanks to @aordway and @mr_mcgoo

sudo chflags noschg

is NOT documented in the man pages. Thanks for helping out.

Crashplan/Code42 also my nemesis here. What were they thinking? It's taken me about 2 hours to find this page!

Posted by
doctordj
Up vote reply of doctordj Down vote reply of doctordj
Add a Comment

sudo chflags noschg is NOT documented in the man pages.

Hmmm, it is in my man page:

… The following keywords are currently defined:

    …

    schg, schange, simmutable
        set the system immutable flag (super-user only)

    …

Putting the letters “no” before or removing the letters “no” from a
keyword causes the flag to be cleared.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo
Add a Comment

None of the above solutions worked for me. Is there any other way to be able to remove the file with "Operation not permitted" error?

$ ls -lOe X11 
lrwxr-xr-x  1 omeran  staff  restricted    8B Mar 24  2017 X11 -> /opt/X11
$ sudo chflags -hv noschg X11 
$ 
$ sudo rm -rf X11
rm: X11: Operation not permitted
Posted by
omeran
Up vote reply of omeran Down vote reply of omeran
Add a Comment