Can't delete or move item from trash using `sudo rm`, superuser account, or even single user mode

Question

At some point in the past I was messing around with the battery menu on my 2012 MacBook Pro running High Sierra to see if I could it to display the estimated time remaining rather than a percentage. Anywho, I created a copy of the file /System/Library/CoreServices/Menu Extras/Battery.menu which I no longer needed, so I trashed it.

Since then I have been unable to move the item from the trash or delete it.

I have tried:

• deleting normally
• using the force delete option (option + delete)
• trying to drag item out of trash (makes a copy, which is deletable)
• running sudo rm -vrf ~/.Trash/Battery.menu (result: "Operation not permitted")
• renaming and moving the file with sudo mv ~/.Trash/Battery.menu (result: "Operation not permitted")
• running the above commands after su in Terminal
• using the root account to try the above
• booting into single user mode, mounting the file system, using above commands. (result: "Operation not permitted")
• using setfile to try to set the busy attribute to not busy and to unlock the file (though it is not locked) using setfile -a z ~/.Trash/Battery.menu. Result: "ERROR: Unexpected Error. (-5000) on file: /Users/myuser/.Trash/Battery.menu"
• repairing permissions, then trying everything again
• booting into recovery, turning off SIP, and trying to delete again.

Any ideas?

Answer 1

I recently had a file I could not delete from Trash. Finally I moved it from the Trash back to the Desktop, which I have synced to iCloud. Then I was able to use the Files app on my iPhone to delete it.

Another path to pursue: boot to recovery and turn off SIP (until you get the file deleted.)

Answer 2

Recovery to delete?

I see you booted into recovery to disable SIP, but did you attempt the delete from the terminal while in recovery mode? Any files that are not open/protected by the currently-running OS should be manageable.

Answer 3

Why aren't you allowed to delete that file?

As you are getting the "Operation Not Permitted" message, I can tell that the file is protected by the system and is therefore extremely hard to delete through normal deletion means (as you have tried).

You could normally run sudo rm -rf Battery.menu to delete this file but as mentioned above, it won't work.

How to fix that error? (And delete the file)

To delete the unwanted file, run this command in Terminal :

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass rm -rfv Battery.menu

This will bypass every restriction that are in place causing it to show the error shown above ("Operation Not Permitted") when running sudo rm -rf Battery.menu.

Note that "bypass" is still located in /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass for me.