2

I'm using a managed Mac and want to remove certain directories and applications. I have tried to do it in the following way:

sudo rm -r /FileDirectory/File

But this did not work. Here is the output:

override rwxr-xr-x  username/wheel for /FileDirectory/File? y
rm: /FileDirectory/File: Permission denied

Why can't I escalate privileges to remove these files?

5
  • There is mandatary access control on some of the OS files on MacOS. I am not the expert, but hopefully some one here is. For now, ask should you be removing these files? Can you tell us more about which files. Dec 4, 2019 at 8:29
  • As an aside: you don't need -r for removing a file (it is for directories). Dec 4, 2019 at 8:31
  • @ctrl-alt-delor It's just some program files. Nothing essential. It's my attempt to work around a corporate management policy that doesn't want me to delete a certain program. I have admin privileges on the machine.
    – supernova
    Dec 11, 2019 at 15:05
  • It looks like they are using mandatory access control. Or mount-point settings. Dec 11, 2019 at 19:45
  • I’ve seen this happening with files copied from a FAT32 drive to MacOS, moved to .Trash where emptying the trashcan then fails. Sigh.
    – Jens
    Oct 11, 2021 at 11:15

1 Answer 1

1

Permission denied usually means that the file or folder is under SIP control (System Integrity Protection). SIP controlled files and folders cannot be deleted (and often neither viewed), even if you prefix the command with sudo.

If you want to remove the file, the only way is to temporarily disable SIP. This requires a few reboots though:

  1. Reboot your Mac to enter recovery mode - see Mac startup key combinations to find out how to do this on your Mac
  2. When in recovery mode, select Terminal from the Utilities menu
  3. Enter csrutil disable and confirm the warning, then wait until the command has finished
  4. Enter shutdown -r now to reboot into normal operating mode
  5. When in normal mode, again open Terminal and remove the file(s) using sudo rm - this time it should succeed
  6. Reboot again to enter recovery mode
  7. When in recovery mode, again select Terminal from the Utilities menu
  8. Enter csrutil enable and confirm, then wait until the command has finished
  9. Enter shutdown -r now to reboot into normal operating mode

When back in normal mode, you may verify that SIP protection has been successfully re-enabled by entering csrutil status in Terminal.

Please note that is absolutely recommended to immediately re-enable SIP. You should not run your Mac without SIP unless you know exactly what you are doing.

5
  • 1
    Is there a reason to not delete the file while in rescue mode? That would avoid having to reboot the system with SIP disabled.
    – Kusalananda
    Nov 3, 2022 at 6:28
  • @Kusalananda Do you refer to recovery mode? Of course, if the file can be deleted with SIP enabled, there is no reason to disable SIP. However, the question is about when a file cannot be deleted by root.
    – not2savvy
    Nov 3, 2022 at 8:58
  • Sure, but after csrutil disable, SIP is disabled, right? So there's no need to reboot. Just delete the file and enable SIP again.
    – Kusalananda
    Nov 3, 2022 at 9:10
  • 1
    @Kusalananda Oh I see. That‘s correct. If the file is not on a file system that needs to be mounted, then this one step is not necessary.
    – not2savvy
    Nov 3, 2022 at 14:09
  • I had to disable csr to remove an user directory and no csr is not disabled right away when doing ˋcsrutil disable`, you have to reboot first.
    – Raphaël
    Apr 5 at 10:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .