Undeletable file

TidBITS Talk
1

OK…I’ve got this undeletable file and can’t figure out how to get rid of it…rebooting doesn’t help.

Running Big Sur and in /Users/Shared I’ve got a file named Install macOS Mojave so it’s been around through a couple of OS updates. Inside the package there’s a single file at Contents/SharedSupport/InstallESD.dmg. Get Info says system has R/W and wheel and everyone have R Only access…and I’m unable to change the access even when logged in as an admin user.

Moving the package to the trash requires admin credentials…but when I try to empty the trash I get “can’t be completed because the file is in use”.

Tried shift booting so nothing extraneous gets loaded and logging in as admin user…no luck.

Tried logging in as admin, launching terminal, and then su to root (I enabled the root user long ago) and then deleting it from terminal…no luck.

Doing ls -la in terminal as root shows
-rw-r–r-- 1 root wheel 5544818527 Dec 12 2020 InstallESD.dmg

So how do I get rid of this file…my guess is I need to chmod of some sort and/or then use some sort of rm command with the right magical incantation switches afterwards. I’m comfortable with slight to minimal user use of terminal but a command line geek I’m not…so I hope somebody smarter than me can point me to the obvious solution. Boot into single user mode maybe? Who knows.

Thanks.

2

Is it mounted?

3

My favorite ‘trick’ for getting rid of pesky files like this is to move them to /tmp/ and then rebooting. macOS clears out /tmp/ on reboot, so it should take care of it.

Assuming that the file is located at

'/Users/Shared/Install macOS Mojave.app/Contents/SharedSupport/InstallESD.dmg'

then you would want to do:

sudo mv -vf '/Users/Shared/Install macOS Mojave.app/Contents/SharedSupport/InstallESD.dmg' /tmp/

or even

sudo mv -vf '/Users/Shared/Install macOS Mojave.app' /tmp/

And then reboot.

2 Likes
4

Dana is on the right track here. Check with Disk Utility (with “Show All Devices” enabled) and you’ll be able to unmount then delete it.

5

Al and Dana…nope, not mounted. I had already checked that.

Tjlouma…It moved just fine to /tmp/ but after 2 reboots it’s still there…so apparently on my machine it doesn’t get emptied out on restart.

At least it’s gone someplace where I won’t see it. Strange that it didn’t get trashed on restart. I moved the file in my daily driver non admin account but it’s in sudoers and it disappeared from /Users/Shared and moved to /tmp/ in terminal but didn’t get emptied.

After the reboot…went into terminal, su to admin, then su to root. Drilled down in /tmp until I was in the /Contents/SharedSupport folder in the file and InstallESD.img is there when ls -la. As root issued rm InstallESD.dmg and got override rw-r–r-- root/wheel restricted for InstallESD.dmg? Answered y and got Operation not permitted.

I’ve never heard of root not being able to delete a file. Permissions on InstallESD.dmg are -rw-r- - r - - root wheel.

6

Are there any ACLs attached to the file? Use ls -ale. For example, ls -ale in my home directory looks like this:

$ ls -ale
[...]
drwx------+  12 blm   staff     384 Aug 22 11:52 Desktop
 0: group:everyone deny delete
[...]

ACLs can be manipulated using chmod. Of course if there are no ACLs, then that’s not it.

7

Have you tried holding down the option key while clicking on “Empty Trash”. I don’t know about Big Sur, but this sometimes worked with previous OS versions.

8

The on-disk structure can become damaged so that a file can not be deleted except by initializing the containing volume. I have had this happen once in many years of OS X usage. It was on a data volume, so my backup saved the day. Absolutely no UNIX-foo worked and this was pre SIP.

9

I’m curious, if you put this Mac in TDM and access its disk from another Mac (i.e. without respecting privileges), can you then delete the file?

10

k

Most likely not since the problem is corrupt directory data which the OS tools can not modify.

11

Apologies, @james.cutler I was not clear. My question was directed at the OP, @neil1 . If it is not directory corruption, I’d be curious if circumventing permissions allows to get around this.

12

It’s a moot point for me anyway since I don’t have a Thunderbolt 2 cable and a TB2 to TB3 adapter to hook it to my wife’s M1 Air or 2019 iMac. At least in /tmp I don’t see it any more and everything else in there is dated after my last reboot so whatever is wrong with it keeps even a reboot or root from killing it. Everything I’ve got says the file is fine.

I haven’t tried mounting and then I mounting the image…the next time I have the laptop open I will try tha5 although I don’t expect it to help. I already tried every simple deletion trick I know of.

13

OK, well now I’m both curious and annoyed at this file.

Try the following, replacing '/tmp/whatever/Contents/SharedSupport/' with whatever folder the InstallESD.dmg is in.


cd '/tmp/whatever/Contents/SharedSupport/'

sudo chflags noschg InstallESD.dmg 

sudo chmod u+w InstallESD.dmg 

sudo rm -fv InstallESD.dmg

If that doesn’t work, try the same commands on the /SharedSupport/ folder and maybe even on the /Contents/ folder, and then try it again.

Report back any output you get from any of those commands. If it works, only the last one should say anything, and that would be the file being reported as deleted.

2 Likes
14

Permissions do not make any difference to garbled directories.

15

Has it been determined this is the problem? I see suggestions that it might be that, but no verification. I’d still check for ACLs or flags. You can check everything with ls -aleO@.

16

Have you tried running First Aid in Disk Utility to see if that makes any difference?

1 Like
17

OK…more info on this one…although since it’s now in /tmp/ at this point and no longer visible unless I go looking for it…and it’s not taking up but a few GB of drive space.

Yep…tried Disk Utility and fsck from the command line after doing su root…all is fine.

Disk Utility does not show it as mounted under All Devices.

Went to /tmp in Finder and drilled down to the .dmg file…right clicked and selected Mount and it mounted and opens just fine…so apparently the image itself isn’t damaged. Unmounted. Went back to terminal, su to admin, su to root, tried to delete the .dmg file from where it’s buried in the package. Operation not permitted even though I answered Y to the question override rw-r–r-- root/wheel restricted for InstallESD.dmg? Y

ls -la in /tmp shows this
drwxr-xr-x 3 root wheel 96 Dec 12 2020 Install macOS Mojave.app

As root…followed tjluoma’s suggestions for chgflgs, chmod, and rm…result operation not permitted.

Tried those same commands on the SharedSupport directory above InstallESD.dmg…failed since directory not empty so didn’t try the Contents directory above that either.

Tried emptying trash with the option key…no luck.

Tried Commander 1 running as admin user…no luck.

Can’t try TDM since I don’t have the right set of cables and adapters to connect TB2 to my iMac.

So…there’s clearly something broke either with the .dmg, the package, or the flag/permission/something else entirely.

I’m happy to just ignore it since it’s not bothering me any more…but OTOH if I’ve roused anybody’s curiosity enough I’m more than happy to keep trying more suggestions…but initializing the volume and starting over is more work than I’m really interested in since everything appears to be just fine except I can’t delete the file.

I didn’t mention before that they laptop doesn’t have the original Apple SSD in it…it was replaced long ago by an OWC 1 TB one…although that’s not likely anything to do with the issue.

18

Can you try ls -lO on the file, to show us the “file flags” and show us the output? (Those options are lower case Lima, followed by upper case Oscar.) That should print something like this:

-rw-r--r--  1 username  wheel  uchg 0 24 Aug 23:46 filename

Note uchg in the fifth column like this… that’s “user immutable”. There’s also schg (“system immutable”, which was mentioned earlier in the thread), and other possibilities: see man chflags.

A file with uchg set on my system gives “Operation not permitted” when I try to remove it. If that is what you are seeing also, try chflags nouchg filename to clear the flag, then try to remove the file again.

2 Likes
19

Ooh! That made me look back and realize that I had left that out of the commands that I had intended to suggest.


	sudo chflags nouchg InstallESD.dmg

was meant to be the 3rd command – immediately following


	sudo chflags noschg InstallESD.dmg
20

Boot into single user mode maybe?

You’re on the right track, but you’re still booting from the same system volume.

Instead, I recommend the following:

  1. Boot into recovery,
  2. Select Terminal from the Utilities menu,
  3. Mount your boot drive* (called Macintosh HD, unless you’ve renamed it), then
  4. Switch to the tmp directory. One of these two should work:
    a. cd /System/Volumes/Data/tmp then ls -al to see if the file is there. If not, try:
    a. cd /System/Volumes/Macintosh\ HD/tmp followed by ls -al to see if the file is there.
  5. Once you’re in the correct directly, then rm -r Install\ macOS\ Mojave.app should delete it.

I haven’t tested this, and I’m mostly working from memory, but this should work. Note that you might also have to disable SIP to get this to work. If you do, remember to re-enable it when you’re done.

3 Likes