File can't be moved by root on OS X

Question

I tried to move a few files to a subfolder on OS X. One refused to move. It said Operation not permitted. I tried again as root:

$ sudo mv file subfolder/
mv: rename file to subfolder/file: Operation not permitted
$ sudo mv file filex
mv: rename file to filex: Operation not permitted
$ lsattr file
lsattr: Inappropriate ioctl for device While reading flags on file

I tried lsattr on other files; all files I tried gave me the same message: Inappropriate ioctl for device While reading...

Coming from Linux, I did not know about flags so here is the output of ls -leO@ file:

$ ls -leO@ file otherfile
-rwxrwxrwx  1 eeytan  staff  uchg 79549 Nov 11  2010 file
-rw-r--r--  1 eeytan  staff  -     5071 Sep  7 02:37 otherfile

I tried the OS X Disk Utility; it said there were no errors on my disk. What's going on here?

Answer 1

Sounds like the file is locked to me, which is why the uchg attribute is appearing. You should be able to use the following command to remove the locked attribute:

chflags nouchg file

or right-click the file in the Finder, click "Get Info" then uncheck the "Locked" checkbox

Answer 2

For people stumbling upon this in an OS X 10.11+ era (El Capitan or newer): Apple has added a whole new layer of security in OS X. They have taken away some privileges from root. The file you are trying to modify has a restricted flag. Only restricted processes which are signed by Apple will be able to modify these files. However, you can disable this security system by booting in recovery mode and disabling it in a Terminal by doing: csrutil disable.

Alternatively, you can also just start Terminal in Recovery Mode and delete the file there. Or even try booting in a Linux environment with HFS+ support (at least if you're not on APFS yet) to change the file.

Answer 3

Try:

chflags -f -R nouchg directory

on a higher level directory to stop this problem.

Answer 4

I had a file I couldn't delete in terminal:

$ sudo ls -leO@ [email protected]/Documents/.%cb_defense/cb.doc
-rw-rw-rw-  1 root  wheel  - 41984  1 Mar 11:20 [email protected]/Documents/.%cb_defense/cb.doc

$ sudo rm -rf [email protected]/Documents/.%cb_defense/cb.doc
rm: [email protected]/Documents/.%cb_defense/cb.doc: Operation not permitted

What worked for me was opening Finder and deleting the containing directory whole. The way I understand it, Finder deletes directories as a unit entirely disregarding their contents, so it's not subject to the same restrictions as regular rm -rf.

Answer 5

I had this issue too, and I discovered that the folder the file was in was locked. So make sure that's not true. Do 'get info' on the folder in the finder, and make sure the locked checkbox is not checked.

Answer 6

Under OS 10.15 this worked for me:

1. Recovery mode: command + R
2. Utilities -> Terminal
3. rm -r /path/to/file/or/dir/to/remove (The -r alone worked for me -- If you need it rm -rf force mode)
4. Reboot

Answer 7

A previous answer said to use:

chflags -f -R nouchg directory

There are two different attributes that prevent changing a file. "uchg" prevents the user from changing the file; "schg" prevents the system from making a change. Use ls -le0@ to see which is your problem, or use apple-I: if "locked" is checked but not greyed out, then "uchg" is set. If "locked" is checked AND greyed out, then "schg" is set.) If "uchg" is set, the previous answer will work. If "schg" is set, then do this instead:

chflags -f -R noschg directory

Answer 8

Before using arcane commands, confirm your System Preferences

Terminal may not have permission to access your present working directory.

1. Note your path (e.g. in Terminal, type pwd).
2. Visit System Preferences > Security & Privacy > Privacy > Files and Folders
3. Confirm there is a check mark next to any volumes and directories that appear in your path.

If Terminal has permissions and the command still gets an error, check the solutions provided in other answers.

Answer 9

I realize this is a very old topic but I don't see this thread addressing my symptom so I thought I'd post another opinion.

I had this happen to an external drive that had been functioning perfectly on a Snow Leopard iMac, which got upgraded to El Capitan along the way. Earlier this year, I took that drive and put it in a new Windows 10 box which was running Paragon HFS for Windows. I copied hundreds of GB of files FROM Windows TO HFS+ on that drive and plugged it back into the iMac. Everything worked fine, except one shell script I had that staged files for backup encountered this uchg issue.

In short: files and folders created under El Capitan or Windows 10 using Paragon HFS, when moved back to a Snow Leopard box, the "locked" radio box will NOT be checked when you select Get Info in the Finder. However, others' suggestions worked fine for me:

• verify that's the issue by running ls -leO@ (that's a capital oh) on a suspect file
• as root, run chflags -R nouchg on the parent directory (there's no -f in Snow Leopard)

It'll work, just don't expect the exact same visual cues if your drive has gone between operating systems or if you use Paragon HFS.