5

I'm having trouble emptying the trash on Catalina. FileVault is enabled. Trying to empty from Finder warns X11R6 can't be modified or deleted because it's required by macOS. It's a link to /opt/X11 which is a regular directory. enter image description here OK let's try in Terminal:

fifteen:.Trash elliott$ pwd; ls -al
/Users/elliott/.Trash
total 272
drwx------    4 elliott  staff     128 Nov 11 21:44 .
drwxr-xr-x@ 125 elliott  staff    4000 Nov 10 22:23 ..
-rw-r--r--@   1 elliott  staff  135172 Nov 11 21:44 .DS_Store
drwxr-xr-x    3 root     wheel      96 Nov 11 21:42 Security

fifteen:.Trash elliott$ sudo rm -rf Security/
Password:
rm: Security//usr/X11R6: Operation not permitted
rm: Security//usr: Directory not empty
rm: Security/: Directory not empty

fifteen:.Trash elliott$ ls -l Security/usr/
total 0
lrwxr-xr-x  1 root  wheel  8 May 19 11:37 X11R6 -> /opt/X11

I have already given Terminal full disk access in System Preferences.

Checking the rm command with dtruss I see it fails here:

unlink(".Trash/Security/usr/X11R6\0", 0x0, 0x0)      = -1 Err#1
write_nocancel(0x2, "rm: \0", 0x4)       = 4 0
getrlimit(0x1008, 0x7FFEED8FA680, 0x0)       = 0 0
write_nocancel(0x2, ".Trash/Security/usr/X11R6\0", 0x19)         = 25 0
write_nocancel(0x2, ": \0", 0x2)         = 2 0
write_nocancel(0x2, "Operation not permitted\n\0", 0x18)         = 24 0

I also verified that this file is on the read-write Data partition:

sh-3.2# ls -l /System/Volumes/Data/Users/elliott/.Trash/Security/usr/
total 0
lrwxr-xr-x  1 root  wheel  8 May 19 11:37 X11R6 -> /opt/X11
2

This is a known issue that has impacted a number of users following an upgrade to Catalina1.

The best way to resolve this is to disable System Integrity Protection (SIP), delete the files/empty the trash, then re-enable SIP.

Full instructions provided below for the benefit of users unfamiliar with the process of disabling/enabling SIP:

  1. Startup (or restart) your Mac
  2. Immediately hold down the commandR keys to boot into recovery
  3. Click the Utilities menu and select Terminal
  4. Type csrutil disable and press return
  5. Close the Terminal app
  6. Restart your Mac
  7. Delete the files and/or empty the trash
  8. Restart your Mac
  9. Immediately hold down the commandR keys to boot into recovery
  10. Click the Utilities menu and select Terminal
  11. Type csrutil enable and press return
  12. Close the Terminal app
  13. Restart your Mac

1. In most cases, the affected users had XQuartz installed prior to the Catalina upgrade and during the upgrade process XQuartz isn't uninstalled properly.

| improve this answer | |
  • Thanks! This prompted me to find the command ls -lO which shows that indeed this file is restricted by SIP. I will try this when I'm able to reboot. I wonder if there is any way to add or remove this "restricted" flag. – Elliott Nov 12 '19 at 7:33
  • I've added a way to do this without needing steps 4-11 but you need to construct the full path to your user Trash folder. See my answer - feel free to edit it into your answer if desired. – bmike Dec 20 '19 at 19:56
2

As mentioned, you can fix this in Recovery mode itself. However you must first mount your Macintosh disk (at least on Catalina) to get access to the Trash while in Recovery mode. Here are the steps that worked for me on Mac OS 10.15.4:

  1. Find out the path to your Trash by running this command in Terminal

    echo /Users/$(whoami)/.Trash/?*
    

    Should be something like /Users/bob/.Trash/?*. Note it down on paper or your phone.

  2. Restart your Mac

  3. Immediately hold down commandR to boot into Recovery mode
  4. In Recovery mode, open Disk Utilities
  5. Mount your "Macintosh HD" volume (the main one)
  6. Quit Disk Utility
  7. Click the Utilities menu and select Terminal
  8. The "Macintosh HD" will be available under /Volumes/Macintosh\ HD. Prefix the path you noted down with that. The full path to your trash will be something like this:

    /Volumes/Macintosh\ HD/Users/bob/.Trash/?*
    

    Remember to replace bob there with the right user name.

    Verify by running this in Terminal:

    ls /Volumes/Macintosh\ HD/Users/bob/.Trash/?*
    

    and check that it contains those files you want to delete.

  9. Delete the files:
    rm -rf /Volumes/Macintosh\ HD/Users/bob/.Trash/?*
    
  10. Quit Terminal
  11. Restart your Mac

Note: I actually ran csrutil disable before step 8 and then csrutil enable after step 9, to temporarily disable the System Integrity Protection. I don't know if that was actually required or not. It seems it should not be required while in Recovery mode, but I haven't tested it. Let us know in the comments below.

| improve this answer | |
1

You can also just boot to recovery and remove the folder / files from the Terminal utility while booted to the recovery image. System Integrity Protection doesn't protect your normal system from modifications while booted to another OS.

If you want to get the full path to your user trash folder before you reboot, this command will get you the short name so you can copy this / print this out and have a "cheat sheet" of what to type when you're in recovery:

echo rm /Users/$(whoami)/.Trash/?*

The echo command doesn't delete, when you type the rm and press enter, that will try to delete the files and won't ask for permission or have an undo step, so be sure you have a backup if you think you won't get the path perfect. This will delete everything you put in the trash from your home folder.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .