0

I know how to disable and enable SIP, but is there an easier way to remove ACLs from a user's library? I want to move and/or copy some things from my admin account to my regular account and SIP prevents even sudo from doing it.

Four shutdown/reboot cycles just for this is a nuisance.

1

First, of all you do not need 4 cycles. To enable SIP, you can enter the command below, then restart the Mac.

csrutil clear

You should get the message shown below.

Successfully cleared System Integrity Protection. Please restart the machine for the changes to take effect.

You can disable SIP on a single restart, if you install rEFInd. If properly installed, you can select rEFInd from the Mac Startup Manager. From the rEFInd menu, you can disable SIP and then boot to macOS.

So to summarize, you can enable or disable SIP though a single restart. So the total number of cycles can be reduced from 4 to a total of 2.

As for coping files from one users account to another, I do know were SIP is involved. If one of the accounts has administrator privileges, then you can enter the command below to become the root user.

sudo bash

Once you are the root user, you can enter the necessary commands to copy files between accounts.

Personally, I do not employ the root user. I just use the Finder application. I move (or copy) the files to the Public folder of one account, then switch users and copy the files from the Public folder to the other account.

|improve this answer|||||
  • You are correct about part; I forgot about csrutil. However, I do not want to install rEFInd. As for the other, ACLs prevent tampering with a user’s ~/Library, and SIP prevents removing the ACLs. Neither Finder nor sudo can get around this, so I suspect ‘sudo bash’ will fare no better. – WGroleau Dec 31 '18 at 7:27
  • Can you give an example where a file has an ACL you can not remove? I ask this, because I can modify ACL's without disabling SIP. I assume you are referring to a particular instance. The command sudo bash in itself does not modify ACL's. This command just allows you to become the root user. The root user has elevated privileges. I suppose maybe I should have written sudo chmod. – David Anderson Dec 31 '18 at 9:06
  • sudo chmod -RN will remove all ACLs from a directory that is not SIP protected. It will get errors if the directory is SIP protected. – WGroleau Jan 2 '19 at 7:54
  • @WGroeau: I hoping you would post a particular file or folder in the ~\Library folder where there are ACLs that can not be removed due to SIP. This would give me something to work with. – David Anderson Jan 2 '19 at 13:36
  • There were tons of messages. Finally gave up and created a fresh account that can copy over what it wants. Unfortunately, not transferring ~/Library means all the preferences have to be manually set again. – WGroleau Jan 3 '19 at 1:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .