chflags [-fhv] [-R[-H|-L|-P]] [no] flags file …
Change the uchg, archived, opaque, nodump, sappend, uappend, simmutable, uimmutable, restricted and hidden flags.
| ||||||||||||||||
Use ls -lO† to see the flags .
Changing the flags:
i) > Sharing & Permissions
chflags (e.g., chflags nouchg filename to remove immutable flag if permissions allow).
Without -R ,-H, -L and -P are ignored.
The actions are determined by the last option.
Without -H or -L a symbolic link is not affected.
Standard Unix modes (read/write/execute for user, group and all users) and ownership control access to files and directories are managed via chmod/chown or Finder's Get Info.
MacOS filesystem flags control file access through System Integrity Protection (SIP).
These can be applied to both user and system (example:
Protected Files: Files marked with SIP flags, like those in /System/Library, are inaccessible.
"Garbage Apps" or Local Snapshots: Sometimes appear restricted due to specific app permissions or Time Machine data.
For SIP-Protected Areas:
Shutdown -h now "chgflag"
chgflags, remove file … ).
shutdown -r now "Back to mutliuser "
To set the flags specify a numeric or a comma separated list of keywords.
arch |
The sappnd, schg and restricted flags may only be unset when the system is in single-user mode.
Example:
chflags -v -v nouchg DSCN0608.JPG DSCN0608.JPG: 02 -> 00 chflags -v -v schg xyz chflags: xyx: Operation not permitted #needs root!
Use ls -lO† to see the flags .
-rwxrwxrwx 1 user14 staff - 7888853 Feb 17 09:21 DSCN0672.JPG* -rwxrwxrwx 1 user14 staff uchg 8209104 Feb 17 09:21 DSCN0673.JPG* -rwxrwxrwx@ 1 user14 staff - 3575147 Mar 11 17:59 DSCN0675.JPG
sudo ls -lOog /private/var/db | grep restricted ls: DifferentialPrivacy: Operation not permitted ls: fts_read: Operation not permitted lrwxr-xr-x@ 1 root restricted,hidden 11 Jul 17 06:49 /var@ -> private/var drwxr-xr-x@ 4 restricted 128 Nov 20 18:52 CVMS drwxr-xr-x@ 4 restricted 128 Sep 12 18:40 KernelExtensionManagement -r--r--r-- ←? 1 restricted 536 Jun 7 2019 PreviousSystemVersion.plist drwxr-xr-x@ 19 restricted 608 Dec 31 2022 SystemPolicyConfiguration drwx------@ 2 restricted 64 Jul 17 06:49 com.apple.xpc.roleaccountd.staging drwx-----x@ 4 restricted 128 Sep 12 18:41 datadetectors drwxr-xr-x@ 2 restricted 64 Jul 17 06:49 oah dr-xr-xr-x@ 6 restricted 192 Sep 12 18:41 timezone /Volumes/DATA/user14/Documents > sudo ls -lOog /private/var | grep restricted drwx------@ 2 restricted 64 Jul 17 06:49 install /Volumes/DATA/user14/Documents > sudo ls -lOog / | grep restricted drwxr-xr-x@ 9 restricted 288 Jul 17 06:49 System drwxr-xr-x@ 38 restricted,hidden 1216 Jul 17 06:49 bin lrwxr-xr-x@ 1 restricted,hidden 11 Jul 17 06:49 etc -> private/etc drwxr-xr-x@ 65 restricted,hidden 2080 Jul 17 06:49 sbin lrwxr-xr-x@ 1 restricted,hidden 11 Jul 17 06:49 tmp -> private/tmp drwxr-xr-x 43 restricted 1376 Nov 1 01:31 /usr/share/ drwxr-xr-x@ 11 restricted,hidden 352 Nov 1 01:31 /usr/ lrwxr-xr-x@ 1 restricted,hidden 11 Jul 17 06:49 var -> private/varAll
/System/Library directories and subdirectories orther than Caches, Extensions, Speech and
User Template -> ../../Library/User Template which are sunlink!
chflags aware, including ls, cp, find, install,
dump and restore. In particular pax(backup utility)user14@smac14 Documents % chflags -v -v hidden x x: 00 -> 0100000 user14@smac14 Documents % ls -lO x -rw-r--r-- 1 user14 sw hidden 0 Dec 30 15:30 x user14@smac14 Documents % sed --in-place "s/.//" x user14@smac14 Documents % ls -lO x -rw-r--r-- 1 user14 sw - 0 Dec 30 15:30 xFlags can be bypassed temporarily in Recovery Mode. by disabling SIP (csrutil disable). single-user mode or SIP disable to change. The configuration can be found in
/System/Library/Sandbox/rootless.config./System/Library/Sandbox/com.apple.xpc.launchd.rootless.plist as of tahoe 1/04/26.
All are true and all but 7 are com.apple
Dict {
InstallerRemovableServices =
Dict {
com.apple.XProtect.agent.scanner = true
com.apple.XProtect.daemon.scanner = true
com.apple.dz.dznd.mendoza = true
com.apple.dangerzone.dzlrd = true
com.apple.dz.dznd = true
com.apple.dangerzone.dznd = true
com.apple.usbmuxd = true
}
RemovableServices =
Dict {
com.apple.xscertd-helper = true
com.apple.odproxyd = true
com.apple.PasswordService = true
com.apple.rcd = true
com.apple.webcontentfilter.proxy = true
com.apple.nfsd = true
com.apple.security.FDERecoveryAgent = true
com.apple.screensharing = true
com.apple.AppleFileServer = true
com.apple.deviceinterfaced = true
com.apple.auditd = true
com.apple.telnetd = true
com.apple.Siri.agent = true
com.apple.ReportCrash.Root = true
com.apple.Kerberos.kdc = true
com.apple.ntalkd = true
com.apple.tftpd = true
com.apple.ODSAgent = true
com.apple.emlog = true
com.apple.dnsextd = true
com.apple.netbiosd = true
com.apple.webcontentfilter.dns = true
com.apple.smbd = true
com.apple.xsandaily = true
com.apple.Dock.agent = true
com.apple.locate = true
com.apple.mdmclient.daemon.runatboot = true
com.apple.kdumpd = true
com.apple.xsan = true
com.apple.ReportGPURestart = true
com.apple.ftpd = true
com.apple.getty = true
com.apple.listen_kdb = true
com.apple.ftp-proxy = true
com.apple.ScriptMenuApp = true
com.apple.uucp = true
com.apple.bootpd = true
com.apple.xscertadmin = true
com.apple.comsat = true
com.apple.FolderActionsDispatcher = true
com.apple.fingerd = true
com.apple.CoreDevice.remotepairingd = true
com.apple.Finder = true
com.apple.DiagnosticsReporter = true
com.apple.Kerberos.kadmind = true
com.apple.lightsoutmanagementd = true
com.apple.xscertd = true
com.apple.Kerberos.kpasswdd = true
com.apple.lognoise = true
com.apple.ManagedClientAgent.enrollagent = true
com.apple.mtmfs = true
com.apple.ReportCrash = true
com.apple.AEServer = true
com.apple.atrun = true
org.apache.httpd = true
org.cups.cups-lpd = true
org.ntp.ntpd = true
com.openssh.sshd = true
org.openldap.slapd = true
org.net-snmp.snmpd = true
org.postfix.master = true
} }
/System/Library/Sandbox/rootless.conf