I have a file that can not be removed. When I attempt rm -f /Applications/CrashPlan.app I get "Operation not permitted"
Here is the scenario, CrashPlan.app was installed on the MacBook Pro (MacBookPro14,2) running 10.14.4. I found out it was an older version of CrashPlan so I downloaded the installer for the new version and ran it. The installed failed and left behind a file of size 0K.
-rw-r--r--@ 1 root admin 0 Apr 11 11:43 CrashPlan.app
I then tried to remove the 0K file in terminal with sudo rm -f /Applications/CrashPlan.app and that failed with operation not permitted. I then booted into Recovery mode and ran csrutil disable from terminal and rebooted.
sudo rm -f /Applications/CrashPlan.app still failed with operation not permitted.
I ran csrutil status in terminal to make sure that sip was disabled and got back: System Integrity Protection status: disabled.
I tried booting into single user mode and mounted the drive and tried to rm from there and got the same result. So, from single user mode I did the following:
mv /Applications /ApplicationsOLD
mv /ApplicationsOLD/* /Applications/
and got an error "Operation not permitted" for CrashPlan.app
rebooted and was able to install the new version of CrashPlan, but now I have a folder /ApplicationsOLD that I can not get rid of.
I found the solution.
Doing an ls -lO shows what flags were turned on. In this case the schg flag was on.
ls -lOe CrashPlan.app
-rw-r--r--@ 1 root admin schg 0 Apr 11 10:43 CrashPlan.app
Executing "chflags -hv noschg CrashPlan.app" turned off the schg flag and allowed me to rm the file.