3

My applications folder has an ACE entry which prevents me from deleting its contents (not even as root, with sip disabled). My problem is, that the command

sudo chmod -N /Applications

tells me, that I have no permission to do this. I couldn't believe it and tried it in both single user and recovery mode, to no avail.

Output of ls -leO:

drwxrwxr-x+ 148 root    admin  uappnd,nodump,opaque  4.9K Jul 31 08:55 Applications/
0: group:everyone deny delete

Is there any other possibility to fix this except from reinstalling the OS?

|improve this question
  • You're probably removing the wrong ACL - the /Applications one prevents you from deleting the entire directory - shouldn't you be looking at an ACL on a folder inside Applications? – bmike♦ Jul 31 '17 at 13:02
  • The contents of the folder are, as far as I can tell not the culprit, they just have 777, 755, etc. with no ACL. – redxef Jul 31 '17 at 13:22
2

The proper command to remove the ACE from the folder in SIP-disabled mode is:

sudo chmod -a "everyone deny delete" /Applications

You can also remove (or add) ACL entries by number/index:

sudo chmod -a# 0 /Applications
|improve this answer
  • Yes, and the one I provided just removes all. My problem is not the command, but rather that I cant run it because of permission problems (ironically). – redxef Jul 31 '17 at 12:57
  • @redxef While you're sorting things out sudo -s might be easier to be sure you're root in the shell. Also - what does ls -leO / with the capital O show and spctl --status? You might need to add those to the body of your question or ask a follow on question - the answer above works to remove ACL for me. – bmike♦ Jul 31 '17 at 13:00
  • @redxef BTW for me your command works properly even after adding arbitrary additional ACEs (in ElCap though) – klanomath Jul 31 '17 at 13:03
  • spctl --status returned enabled, I disabled it with --master-disable, which still doesn't solve the problem. I added the output of ls -leO, as you suggested. – redxef Jul 31 '17 at 13:28

You must log in to answer this question.