chflags

change file flags

chflags [-fhv] [-R [-H | -L | -P]] [no]flags file

Change the archived, opaque, nodump, sappend, uappend, simmutable, uimmutable, restricted and hidden flags.

-f forge-ahead, Do not display a diagnostic message if flags could not be changed nor modify the exit status to reflect such failures.
-v
-vv
verbose showing filenames as the flags are modified.
Specify more than once, flags are output in numeric notation.
-R recurse, Change the flags for the file hierarchies rooted in the files instead of just the files themselves.
symbolic links
-h Change the flags of the link itself not than the file to which it points.
-R -H On the command line are followed. (Those encountered in the tree traversal are not followed.)
-R -L all are followed.
-R -P Prevent following. Default.

Without -R ,-H, -L and -P are ignored.
The actions are determined by the last option.
Without -H or -L a symbolic link is not affected.

Standard Unix modes (read/write/execute for user, group and all users) and ownership control access to files and directories. These can be managed via chmod/chown or Finder's Get Info.
In addition MacOS filesystem flags are used to control file access through System Integrity Protection (SIP). These can be applied to both system (example: /System , /usr ) and user files. UIMMUTABLE and UAPPEND can lock files or folders

System Folders: /usr, /Applications, /Library are system-restricted.
Protected Files: Files marked with SIP flags, like those in /System/Library, are inaccessible.
"Garbage Apps" or Local Snapshots: Sometimes appear restricted due to specific app permissions or Time Machine data.

Flags can be bypassed temporarily in Recovery Mode. by disabling SIP (csrutil disable). single-user mode or SIP disable to change.

The configuration can be found in
/System/Library/Sandbox/rootless.config.

/System/Library/Sandbox/com.apple.xpc.launchd.rootless.plist as of tahoe 1/04/26.

All are true and all but 7 are com.apple

Dict {
  InstallerRemovableServices = 
    Dict {
        com.apple.XProtect.agent.scanner = true
        com.apple.XProtect.daemon.scanner = true
        com.apple.dz.dznd.mendoza = true
        com.apple.dangerzone.dzlrd = true
        com.apple.dz.dznd = true
        com.apple.dangerzone.dznd = true
        com.apple.usbmuxd = true
    }
  RemovableServices = 
    Dict {
        com.apple.xscertd-helper = true
        com.apple.odproxyd = true
        com.apple.PasswordService = true
        com.apple.rcd = true
        com.apple.webcontentfilter.proxy = true
        com.apple.nfsd = true
        com.apple.security.FDERecoveryAgent = true
        com.apple.screensharing = true
        com.apple.AppleFileServer = true
        com.apple.deviceinterfaced = true
        com.apple.auditd = true
        com.apple.telnetd = true
        com.apple.Siri.agent = true
        com.apple.ReportCrash.Root = true
        com.apple.Kerberos.kdc = true
        com.apple.ntalkd = true
        com.apple.tftpd = true
        com.apple.ODSAgent = true
        com.apple.emlog = true
        com.apple.dnsextd = true
        com.apple.netbiosd = true
        com.apple.webcontentfilter.dns = true
        com.apple.smbd = true
        com.apple.xsandaily = true
        com.apple.Dock.agent = true
        com.apple.locate = true
        com.apple.mdmclient.daemon.runatboot = true
        com.apple.kdumpd = true
        com.apple.xsan = true
        com.apple.ReportGPURestart = true
        com.apple.ftpd = true
        com.apple.getty = true
        com.apple.listen_kdb = true
        com.apple.ftp-proxy = true
        com.apple.ScriptMenuApp = true
        com.apple.uucp = true
        com.apple.bootpd = true
        com.apple.xscertadmin = true
        com.apple.comsat = true
        com.apple.FolderActionsDispatcher = true
        com.apple.fingerd = true
        com.apple.CoreDevice.remotepairingd = true
        com.apple.Finder = true
        com.apple.DiagnosticsReporter = true
        com.apple.Kerberos.kadmind = true
        com.apple.lightsoutmanagementd = true
        com.apple.xscertd = true
        com.apple.Kerberos.kpasswdd = true
        com.apple.lognoise = true
        com.apple.ManagedClientAgent.enrollagent = true
        com.apple.mtmfs = true
        com.apple.ReportCrash = true
        com.apple.AEServer = true
        com.apple.atrun = true

        org.apache.httpd = true
        org.cups.cups-lpd = true
        org.ntp.ntpd = true
        com.openssh.sshd = true
        org.openldap.slapd = true
        org.net-snmp.snmpd = true
        org.postfix.master = true
    } }

/System/Library/Sandbox/rootless.conf     

For Standard Permissions: Use Finder's Get Info (Cmd+I) > Sharing & Permissions, unlock the padlock (enter admin password), and adjust Read/Write for users/groups. For SIP-Protected Areas Reboot into Recovery Mode (Cmd+R on startup). Open Utilities > Terminal. Disable SIP: csrutil disable, then reboot. Perform your action (e.g., remove file, change flag). Reboot back to Recovery, enable SIP: csrutil enable, then reboot. For Specific File Flags: Use chflags in Terminal (e.g., chflags nouchg filename to remove immutable flag if permissions allow).

To set the flags specify a numeric or a comma separated list of keywords.

arch
archived
002000000
archived (super-user only)
opaque
       10
Directory is opaque when viewed through a union mount.
nodump
       01
sappnd
sappend
010000000
system append-only (super-user only)
uappnd
uappend
       04
user append-only
schg
schange
simmutable
004000000
system immutable (super-user only)
makes the file/folder Locked/Protected and is equivalent to locking the file in Finder's Show Info box.
uchg
uchange
uimmutable
      02
user immutable
Prevents even root from updating owner via chown
hidden
001000000
hidden [Hide item from GUI]
sunlock
    
unlock
sunlink
    
unlick
restricted


The sappnd, schg and restricted flags may only be unset when the system is in single-user mode.

The no prefix causes the flag to be cleared. For example:

nouchg clear the user immutable flag
noappend clear the append flag

Example:

chflags -v -v nouchg DSCN0608.JPG
DSCN0608.JPG: 02 -> 00 

chflags -v -v  schg  xyz  
chflags: xyx: Operation not permitted # needs root!

Use ls -lO to see the flags .

-rwxrwxrwx   1 user14  staff  -      7888853 Feb 17 09:21 DSCN0672.JPG*
-rwxrwxrwx   1 user14  staff  uchg   8209104 Feb 17 09:21 DSCN0673.JPG*
-rwxrwxrwx@  1 user14  staff  -      3575147 Mar 11 17:59 DSCN0675.JPG

Restricted directories

`
sudo ls -lOog /private/var/db                      | grep restricted
ls: DifferentialPrivacy: Operation not permitted
ls: fts_read: Operation not permitted
lrwxr-xr-x@ 1 root  restricted,hidden 11 Jul 17 06:49 /var@ -> private/var 

drwxr-xr-x@   4   restricted      128 Nov 20 18:52 CVMS
drwxr-xr-x@   4   restricted      128 Sep 12 18:40 KernelExtensionManagement
-r--r--r-- ←? 1  restricted      536 Jun  7  2019 PreviousSystemVersion.plist
drwxr-xr-x@  19   restricted      608 Dec 31  2022 SystemPolicyConfiguration
drwx------@   2   restricted       64 Jul 17 06:49 com.apple.xpc.roleaccountd.staging
drwx-----x@   4   restricted      128 Sep 12 18:41 datadetectors
drwxr-xr-x@   2   restricted       64 Jul 17 06:49 oah
dr-xr-xr-x@   6   restricted      192 Sep 12 18:41 timezone

/Volumes/DATA/user14/Documents > sudo ls -lOog /private/var | grep restricted
drwx------@    2   restricted     64 Jul 17 06:49 install

/Volumes/DATA/user14/Documents > sudo ls -lOog /            | grep restricted
drwxr-xr-x@  9   restricted         288 Jul 17 06:49 System
drwxr-xr-x@ 38   restricted,hidden 1216 Jul 17 06:49 bin
lrwxr-xr-x@  1   restricted,hidden   11 Jul 17 06:49 etc -> private/etc
drwxr-xr-x@ 65   restricted,hidden 2080 Jul 17 06:49 sbin
lrwxr-xr-x@  1   restricted,hidden   11 Jul 17 06:49 tmp -> private/tmp
drwxr-xr-x  43   restricted        1376 Nov  1 01:31 /usr/share/
drwxr-xr-x@ 11   restricted,hidden  352 Nov  1 01:31 /usr/
lrwxr-xr-x@  1   restricted,hidden   11 Jul 17 06:49 var -> private/var
All /System/Library directories and subdirectories orther than Caches, Extensions, Speech and User Template -> ../../Library/User Template which are sunlink!

Exit status

1: invalid flags or No such file or directory

See

ls, stat, fts, symlinkl

Exceptions

A limited number of utilities are chflags aware, including ls, cp, find, install, dump and restore. In particular pax(backup utility) is NOT aware .
user14@smac14 Documents % chflags -v -v  hidden x 
x: 00 -> 0100000
user14@smac14 Documents % ls -lO x
-rw-r--r--  1 user14  sw  hidden 0 Dec 30 15:30 x
user14@smac14 Documents % sed --in-place "s/.//" x
user14@smac14 Documents % ls -lO x                
-rw-r--r--  1 user14  sw  - 0 Dec 30 15:30 x