0

On OSX 10.12

A friend's keychain somehow got the "restricted" mode added to it. I know about csrutil disable from safe mode etc, I'd really like to know how it could've happened. He has no idea what he was doing back then, of course.

-r--r--r--@  1 root  wheel  -              0 Aug 5  07:38 .fl043D1EDD
-r--r--r--   1 root  wheel  -              0 Feb 17  2015 .fl947E1BDB
-rw-r--r--   1 root  wheel  restricted 56612 Jul 18 21:02 System.keychain
-rw-r--r--   1 root  wheel  -          33288 Sep 13 15:05 System.keychain-orig
-rw-r--r--   1 root  wheel  -          56612 Jul 18 21:02 System.keychain.2016-09-13.11:28:12
-rw-r--r--@  1 root  wheel  -          55936 Sep 13 23:05 apsd.keychain
1

Check the file /System/Library/Sandbox/rootless.conf - there is a list of all "restricted" directories of files. Also this article could help

  • (sorry, enter posts comment...) Nothing in /Library is there. This is weird. Could it have been an OSX beta that did it, and never undid it? – serafean Oct 12 '16 at 9:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .