chflags [-fhv] [-R [-H | -L | -P]] [no]flags file …
Change the archived, opaque, nodump, sappend, uappend, simmutable, uimmutable, restricted and hidden flags.
| ||||||||||||||||
Without -R ,-H, -L and -P are ignored.
The actions are determined by the last option.
Without -H or -L a symbolic link is not affected.
Standard Unix modes (read/write/execute for user, group and all users) and ownership control access to files and directories.
These can be managed via chmod/chown or Finder's Get Info.
In addition MacOS filesystem flags are used to control file access through System Integrity Protection (SIP).
These can be applied to both system (example: /System , /usr ) and user files.
UIMMUTABLE and UAPPEND can lock files or folders
System Folders: /usr, /Applications, /Library are system-restricted.
Protected Files: Files marked with SIP flags, like those in /System/Library, are inaccessible.
"Garbage Apps" or Local Snapshots: Sometimes appear restricted due to specific app permissions or Time Machine data.
Flags can be bypassed temporarily in Recovery Mode. by disabling SIP (csrutil disable). single-user mode or SIP disable to change.
The configuration can be found in
/System/Library/Sandbox/rootless.config.
/System/Library/Sandbox/com.apple.xpc.launchd.rootless.plistas of tahoe 1/04/26.All are
trueand all but 7 arecom.appleDict { InstallerRemovableServices = Dict { com.apple.XProtect.agent.scanner = true com.apple.XProtect.daemon.scanner = true com.apple.dz.dznd.mendoza = true com.apple.dangerzone.dzlrd = true com.apple.dz.dznd = true com.apple.dangerzone.dznd = true com.apple.usbmuxd = true } RemovableServices = Dict { com.apple.xscertd-helper = true com.apple.odproxyd = true com.apple.PasswordService = true com.apple.rcd = true com.apple.webcontentfilter.proxy = true com.apple.nfsd = true com.apple.security.FDERecoveryAgent = true com.apple.screensharing = true com.apple.AppleFileServer = true com.apple.deviceinterfaced = true com.apple.auditd = true com.apple.telnetd = true com.apple.Siri.agent = true com.apple.ReportCrash.Root = true com.apple.Kerberos.kdc = true com.apple.ntalkd = true com.apple.tftpd = true com.apple.ODSAgent = true com.apple.emlog = true com.apple.dnsextd = true com.apple.netbiosd = true com.apple.webcontentfilter.dns = true com.apple.smbd = true com.apple.xsandaily = true com.apple.Dock.agent = true com.apple.locate = true com.apple.mdmclient.daemon.runatboot = true com.apple.kdumpd = true com.apple.xsan = true com.apple.ReportGPURestart = true com.apple.ftpd = true com.apple.getty = true com.apple.listen_kdb = true com.apple.ftp-proxy = true com.apple.ScriptMenuApp = true com.apple.uucp = true com.apple.bootpd = true com.apple.xscertadmin = true com.apple.comsat = true com.apple.FolderActionsDispatcher = true com.apple.fingerd = true com.apple.CoreDevice.remotepairingd = true com.apple.Finder = true com.apple.DiagnosticsReporter = true com.apple.Kerberos.kadmind = true com.apple.lightsoutmanagementd = true com.apple.xscertd = true com.apple.Kerberos.kpasswdd = true com.apple.lognoise = true com.apple.ManagedClientAgent.enrollagent = true com.apple.mtmfs = true com.apple.ReportCrash = true com.apple.AEServer = true com.apple.atrun = true org.apache.httpd = true org.cups.cups-lpd = true org.ntp.ntpd = true com.openssh.sshd = true org.openldap.slapd = true org.net-snmp.snmpd = true org.postfix.master = true } } /System/Library/Sandbox/rootless.confFor Standard Permissions: Use Finder's Get Info (Cmd+I) > Sharing & Permissions, unlock the padlock (enter admin password), and adjust Read/Write for users/groups. For SIP-Protected Areas Reboot into Recovery Mode (Cmd+R on startup). Open Utilities > Terminal. Disable SIP: csrutil disable, then reboot. Perform your action (e.g., remove file, change flag). Reboot back to Recovery, enable SIP: csrutil enable, then reboot. For Specific File Flags: Use chflags in Terminal (e.g., chflags nouchg filename to remove immutable flag if permissions allow).
To set the flags specify a numeric or a comma separated list of keywords.
arch |
The sappnd, schg and restricted
flags may only be unset when the system is in single-user mode.
The no prefix causes the flag to be cleared. For example:
nouchg |
Example:
chflags -v -v nouchg DSCN0608.JPG DSCN0608.JPG: 02 -> 00 chflags -v -v schg xyz chflags: xyx: Operation not permitted #needs root!
Use ls -lO† to see the flags .
-rwxrwxrwx 1 user14 staff - 7888853 Feb 17 09:21 DSCN0672.JPG* -rwxrwxrwx 1 user14 staff uchg 8209104 Feb 17 09:21 DSCN0673.JPG* -rwxrwxrwx@ 1 user14 staff - 3575147 Mar 11 17:59 DSCN0675.JPG
sudo ls -lOog /private/var/db | grep restricted ls: DifferentialPrivacy: Operation not permitted ls: fts_read: Operation not permitted lrwxr-xr-x@ 1 root restricted,hidden 11 Jul 17 06:49 /var@ -> private/var drwxr-xr-x@ 4 restricted 128 Nov 20 18:52 CVMS drwxr-xr-x@ 4 restricted 128 Sep 12 18:40 KernelExtensionManagement -r--r--r-- ←? 1 restricted 536 Jun 7 2019 PreviousSystemVersion.plist drwxr-xr-x@ 19 restricted 608 Dec 31 2022 SystemPolicyConfiguration drwx------@ 2 restricted 64 Jul 17 06:49 com.apple.xpc.roleaccountd.staging drwx-----x@ 4 restricted 128 Sep 12 18:41 datadetectors drwxr-xr-x@ 2 restricted 64 Jul 17 06:49 oah dr-xr-xr-x@ 6 restricted 192 Sep 12 18:41 timezone /Volumes/DATA/user14/Documents > sudo ls -lOog /private/var | grep restricted drwx------@ 2 restricted 64 Jul 17 06:49 install /Volumes/DATA/user14/Documents > sudo ls -lOog / | grep restricted drwxr-xr-x@ 9 restricted 288 Jul 17 06:49 System drwxr-xr-x@ 38 restricted,hidden 1216 Jul 17 06:49 bin lrwxr-xr-x@ 1 restricted,hidden 11 Jul 17 06:49 etc -> private/etc drwxr-xr-x@ 65 restricted,hidden 2080 Jul 17 06:49 sbin lrwxr-xr-x@ 1 restricted,hidden 11 Jul 17 06:49 tmp -> private/tmp drwxr-xr-x 43 restricted 1376 Nov 1 01:31 /usr/share/ drwxr-xr-x@ 11 restricted,hidden 352 Nov 1 01:31 /usr/ lrwxr-xr-x@ 1 restricted,hidden 11 Jul 17 06:49 var -> private/varAll
/System/Library directories and subdirectories orther than Caches, Extensions, Speech and
User Template -> ../../Library/User Template which are sunlink!
chflags aware, including ls, cp, find, install,
dump and restore. In particular pax(backup utility)user14@smac14 Documents % chflags -v -v hidden x x: 00 -> 0100000 user14@smac14 Documents % ls -lO x -rw-r--r-- 1 user14 sw hidden 0 Dec 30 15:30 x user14@smac14 Documents % sed --in-place "s/.//" x user14@smac14 Documents % ls -lO x -rw-r--r-- 1 user14 sw - 0 Dec 30 15:30 x