Any other Terminal / shell based options to strip all ACLs and extended attributes from a folder?

Question

I'm having some trouble deleting some folders that contain nothing and have no processes or kexts utilizing them (lsof | grep path_element). When I try to delete them (as root) I get:

root@hostname /# rm -fr /path/to/folder
rm: /path/to/folder: Operation not permitted

Even after executing the following to strip ACLs / extended attributes, I still cannot rm -fr the folders:

sudo chmod -RN /path/to/folder
sudo xattr -c -r /path/to/folder

Executing ls shows no attributes:

ls -lea -@ /path/to/folder

Any other options to ensure all permissions are stripped and that an rm operation as root should work?

Depending on the location in question, the folders may be protected by Transparency Consent and Control (TCC) or System Integrity Protection (SIP). What is the actual /path/to/folder? — Gordon Davisson, Aug 31 '20 at 22:32
SIP is off and TCC shouldn't really have anything to do with this since this is on a backup volume at a path something like /Volumes/system_backup_name/private/var/folders/zz/blah/blah/blah... — ylluminate, Sep 01 '20 at 01:16
In Catalina, TCC restricts access to removable volumes, so that could certainly be it. — Gordon Davisson, Sep 01 '20 at 03:59
Have you trying using the command /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass? — David Anderson, Sep 01 '20 at 04:34
Even running /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass rm -fr /Volumes/system_backup_name/path/to/folder still returns Operation not permitted. — ylluminate, Sep 01 '20 at 06:57
@GordonDavisson well, if you really think that could be it, how do I bypass it? I have Terminal, iTerm + zsh all in Full Disk Access already as I've tried those. Do I need more than just the parental process in there (ie, add rm as well)? Is there a way to trigger these sans TCC handling, eg via David's suggestion of using TMSafetyNet's bypass, which also fails? — ylluminate, Sep 01 '20 at 07:02
Solved, needed to use: chflags -R nouchg,noschg /path/to/folder — ylluminate, Sep 01 '20 at 14:13

score 1 · Accepted Answer · answered Sep 01 '20 at 14:13

1

The culprit that was stopping the folder from being deleted was apparently flags being set and so the following finally allowed deletion:

sudo chflags -R nouchg,noschg /path/to/folder

answered Sep 01 '20 at 14:13

ylluminate

5,311

Any other Terminal / shell based options to strip all ACLs and extended attributes from a folder?

1 Answers1