How to remove when sudo rm says operation not permitted?

Asked Apr 23 '20 at 23:11

Active Apr 24 '20 at 01:59

Viewed 1,979 times

I'm trying to get rid of a stray kernel extension from Corel Painter. There is a question and answer about it here. The kextunload command from that answer worked, but I can't remove the files.

sudo rm -rf /Library/Extensions/PainterAudioDriver.kext
rm: /Library/Extensions/PainterAudioDriver.kext/Contents/_CodeSignature/CodeResources:      Operation not permitted
rm: /Library/Extensions/PainterAudioDriver.kext/Contents/_CodeSignature: Operation not permitted
rm: /Library/Extensions/PainterAudioDriver.kext/Contents/MacOS/PainterAudioDriver: Operation not permitted
...
rm: /Library/Extensions/PainterAudioDriver.kext: Operation not permitted

How can it not be permitted when I'm using sudo? How do I remove them?

I guess this has something to do with it...

% ls -ld@ /Library/Extensions/PainterAudioDriver.kext
drwxr-xr-x@ 3 root  wheel  96 Jan  7  2016    /Library/Extensions/PainterAudioDriver.kext
       com.apple.rootless    0

edited Apr 24 '20 at 01:59

airsquared

5,107

asked Apr 23 '20 at 23:11

Rob N

1,660

This is because of SIP which is enforced because of the com.apple.rootless xattr, you will need to disable it to modify those files. (but this seems like an odd case because SIP shouldn't be protecting those files) – airsquared Apr 24 '20 at 01:56
What version of macOS is running on this Mac? – IconDaemon Apr 24 '20 at 01:58
The lastest: Catalina 10.15.4. – Rob N Apr 24 '20 at 02:12
I disabled SIP, and still face this error – IgorGanapolsky May 12 '22 at 17:33

How to remove when sudo rm says operation not permitted?

0 Answers0