rm results in "operation not permitted"

I have a file that can not be removed. When I attempt rm -f /Applications/CrashPlan.app I get "Operation not permitted"


Here is the scenario, CrashPlan.app was installed on the MacBook Pro (MacBookPro14,2) running 10.14.4. I found out it was an older version of CrashPlan so I downloaded the installer for the new version and ran it. The installed failed and left behind a file of size 0K.


-rw-r--r--@ 1 root admin 0 Apr 11 11:43 CrashPlan.app


I then tried to remove the 0K file in terminal with sudo rm -f /Applications/CrashPlan.app and that failed with operation not permitted. I then booted into Recovery mode and ran csrutil disable from terminal and rebooted.


sudo rm -f /Applications/CrashPlan.app still failed with operation not permitted.


I ran csrutil status in terminal to make sure that sip was disabled and got back: System Integrity Protection status: disabled.


I tried booting into single user mode and mounted the drive and tried to rm from there and got the same result. So, from single user mode I did the following:

mv /Applications /ApplicationsOLD

mkdir /Applications

mv /ApplicationsOLD/* /Applications/


and got an error "Operation not permitted" for CrashPlan.app


rebooted and was able to install the new version of CrashPlan, but now I have a folder /ApplicationsOLD that I can not get rid of.


Any ideas?

Up vote post of aordway Down vote post of aordway
6.2k views
Posted by
aordway
Reply
Add a Comment

Replies

I found the solution.


Doing an ls -lO shows what flags were turned on. In this case the schg flag was on.

ls -lOe CrashPlan.app

-rw-r--r--@ 1 root admin schg 0 Apr 11 10:43 CrashPlan.app


Executing "chflags -hv noschg CrashPlan.app" turned off the schg flag and allowed me to rm the file.

Posted by
aordway
Post not yet marked as solved Up vote reply of aordway Down vote reply of aordway
Add a Comment

Adding some extra detail to aordway's answer - I had similar issues with FortiClient.app and FortiClientUninstaller.app

To remove the files that just would not go with any other method, I did the following in terminal;

cd /Applications
sudo chflags -hv noschg FortiClient.app
rm -R FortiClient.app
Posted by
mr_mcgoo
Up vote reply of mr_mcgoo Down vote reply of mr_mcgoo
Add a Comment