1

I stupidly used my terminal to create a symbolic link typing this:

sudo ln -s /bin/tcsh tcsh

And now I need to delete it. I tried

sudo rm tcsh

but when I authenticate it tells me:

override rwxr-xr-x root/wheel restricted,compressed for tcsh?

and even if I type y and press enter it tells me:

rm: tcsh: Operation not permitted.

Is there anything I can do to fix this?

klanomath
  • 66,391
  • 9
  • 130
  • 201
user216334
  • 11
  • What is the current directory when you issue sudo rm tcsh command? What was the current directory when you executed sudo ln -s /bin/tcsh tcsh? – techraf Dec 22 '16 at 02:15
  • Sorry, I hadn't seen this (totally new to the site). Good question, I want to say that I was under /users/myusername but if I type ls -l tcsh it tells me that there is nothing with that name...is there a way for me to find out? – user216334 Dec 22 '16 at 02:41
  • sudo find / -name tcsh -type l 2> /dev/null – techraf Dec 22 '16 at 02:44
  • it says -type 1: unknown type – user216334 Dec 22 '16 at 02:48
  • Ooops...sorry, this is very new to me:) What kind of output should i get? – user216334 Dec 22 '16 at 02:51
  • It does not give me a path. Unless that can take more than 5 minutes? – user216334 Dec 22 '16 at 02:55
  • @user216334 Depending on the number of files on your main volume and other mounted volumes & shares it may take much longer. – klanomath Dec 22 '16 at 02:59
  • If this doesn't work: do you think that updating to Sierra might help fix whatever I have done? Or would it make it worse? – user216334 Dec 22 '16 at 03:00
  • @user216334 I recommend a second search with sudo find / -name tcsh 2> /dev/null. Comparing both results you can distinguish soft links and real tcsh execs: the real tcsh (or a copy of it somewhere else won't appear in the first output). Upgrading to Sierra will not really help. – klanomath Dec 22 '16 at 03:07
  • Most likely you don't have any problem at all. Possibility (1) You have not created any link and tried to delete a protected /bin/tcsh file. Apple released a system that prevents it, so you (or some malware, or some buggy software) don't mess it. Possibility (2) You have created a link, which has zero influence on anything. And then tried to delete a protected /bin/tcsh file. That's all. – techraf Dec 22 '16 at 03:37
  • If you are unsure what you are doing, then use absolute paths with rm and other commands - at least what you have done will remain in the shell history. – techraf Dec 22 '16 at 03:42

1 Answers1

2

It seems you are either trying to remove your original file /bin/tcsh or another tcsh copied to a different path. You can't link /bin/tcsh to tcsh if you are in the /bin folder because that's forbidden.

A soft link of tcsh usually isn't protected by SIP and you have to search for it and delete it. If you somehow managed to copy tcsh to another path, which then prevents a software you are using from working, you may have to delete it there.

To remove a protected tcsh copy, boot to Recovery Mode, disable SIP, reboot to your main volume and remove the link.

  1. Reboot your Mac into Recovery Mode by restarting your computer and holding down Command+R until the Apple logo appears on your screen.
  2. Click Utilities > Terminal.
  3. In the Terminal window, type in csrutil disable and press Enter.
  4. Restart your Mac.
  5. Remove the tcsh copy
  6. Reboot your Mac into Recovery Mode
  7. Click Utilities > Terminal.
  8. In the Terminal window, type in csrutil enable and press Enter.
  9. Restart your Mac.

Link: How do I disable System Integrity Protection (SIP) AKA “rootless” on OS X 10.11, El Capitan? This is also valid for macOS Sierra!

Community
  • 1
klanomath
  • 66,391
  • 9
  • 130
  • 201
  • Thanks for answering! Just to make sure I don't screw this up more than I already did: when I try to remove the link, sudo rm tcsh should work, right? – user216334 Dec 22 '16 at 01:36
  • Ok. I hope I'm not abusing of your patience, but I have one more question: to be 100% sure that I am removing the link and not the original file i type man rm tcsh? Thank you, thank you, thank you. – user216334 Dec 22 '16 at 01:47
  • I see. I am using El Capitan, as well. It says -rwxr-xr-x 1 root wheel, which I assume means this is the actual executable file. Which begs the question: how do I find the link? I know it's somewhere, and it's preventing a software I use from working... – user216334 Dec 22 '16 at 02:16
  • Would updating to Sierra solve my problem? – user216334 Dec 22 '16 at 02:18
  • @techraf You are right. I didn't check the error output: override rwxr-xr-x root/wheel restricted... properly and didn't realize the missing l...! I'm not surreal - I'm Vader and I will send my new VW Diesel Death Star if you call one of my answers surreal again! – klanomath Dec 22 '16 at 02:32
  • SIP works on a directory level. A file copied "out of" the SIP-protected directory will not be SIP-protected. And there is no mechanism disallowing copying ("somehow managed to copy tcsh to another path" is as easy as cp /bin/tcsh ~ - not even sudo is required - no need for "somehow" here). I still don't understand that part of your answer. – techraf Dec 22 '16 at 05:03