I know I am able to lock an application using:

sudo chmod a-x /Applications/'Application'.app 

but I encountered a problem while trying to lock an application, like safari, which is built in.

chmod: Unable to change file on /Applications/Safari.app: Operation not permitted

Is there a way to override the permissions?

  • What problem did you encounter? – glenn jackman Jan 18 '16 at 22:16
  • It said chmod: Unable to change file on /Applications/Safari.app: Operation not permitted – Jack Jan 18 '16 at 22:48
  • And yes I am admin – Jack Jan 18 '16 at 22:49
  • This is SIP; you can't get around it without disabling the whole thing; you probably want the parental controls instead. – Michael Homer Jan 18 '16 at 23:19
  • Is there a way to enable specific parental controls from terminal and disable parental controls from terminal? – Jack Jan 18 '16 at 23:22

Being unable to change permissions as root on a built-in application or system file on OS X is indicative of System Integrity Protection, a new security feature added in 10.11, which

restricts the root account and limits the actions that the root user can perform on protected parts of OS X.

Protected parts include /System and pre-installed applications, along with the traditional Unix tree.

Any item under a path listed in /System/Library/Sandbox/rootless.conf, or with the com.apple.rootless extended attribute listed by xattr -l, is unmodifiable except by the users listed in the first column of that file, unless SIP has been disabled in recovery mode (which I would advise against, generally).

By nature, this protection includes the root user, and anyone with admin or sudo rights. Only Apple-signed binaries can modify these files.

You can also see this popular reporting article on Ars Technica from when the feature was introduced for more details, including some more about how it works and what the purpose is.


You should be able to achieve your desired results as the root user on Mac OS X prior to 10.11 "El Capitan".

"The user account named "root" is a special user in UNIX-style operating systems that has read and write privileges to all areas of the file system."

If you have not already enabled the root user, here are the instructions on how to enable and use the "root" user in OS X.


On the CLI:
1. Type su to switch to the root user.
2. Then chmod a-x /Applications/Safari.app will work

  • 1
    This just isn't correct, as noted in the comments on the question. – Michael Homer Jan 19 '16 at 0:23
  • It indeed works, I've tested it. The comment on the question indicates he used sudo as admin. The root user has higher privileges than a sudoer or "admin" user. – AJ. Jan 19 '16 at 0:30
  • The root user has higher privileges than a sudoer or "admin" user. No it doesn't. – Michael Homer Jan 19 '16 at 0:34
  • Michael, Why don't you try it and report back. IT WORKS! – AJ. Jan 19 '16 at 0:35
  • And — just to make sure — I just tried it too, and it definitely doesn't work. The error reported in the question is indicative of SIP, the entire point of which is that even root can't get around it. – Michael Homer Jan 19 '16 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.