10

Currently Running: macOS Catalina 10.15.1

Issue: Ever since I upgraded to Catalina, macOS is not allowing me to change read and write permissions on system protected files, hence, I am not able to tweak the system as per my likes and dislikes.

Steps Tried To Solve The Issue: SIP, always remains disabled on my boot drive. So, no question arises regarding any conflict with system integrity protection.

I have also tried to force change the permissions on the system files I want to edit using certain brute force commands, which I can't recall the name of, right now. But, I have tried.

As of now, I am still unable to change read and write permissions on system protected files and resources.

3
  • 1
    Which files are you trying to change? Catalina stores most system files on a separate read-only volume; this overlaps with SIP's protection, but it's actually independent of SIP and disabling SIP doesn't make the volume read-write. See the Ars Technica review of Catalina for more details. – Gordon Davisson Nov 20 '19 at 6:04
  • @GordonDavisson I am trying to edit system core services – Sayan Nov 20 '19 at 6:24
  • 1
    I have been using directories /data /git and /shared for ages. Upwards of 100gb . I have a lot of code that looks for those: and we have linux systems with paths expected that way. Realizing that there is a significant cost for me to deal with changing these am I simply hosed? – WestCoastProjects Apr 11 '20 at 5:24
16

Catalina introduced a new feature that overlaps and reinforces the filesystem protections that SIP provides. What it does is split the files between two volumes: a system volume containing Apple-provided system files, and a "data" volume containing all non-Apple and modifiable files. The system volume is mounted read-only as / (the root filesystem), and the data volume is mounted with read-write access as /System/Volumes/Data. There are also "firmlinks" that merge the content from the data volume in where it "belongs" (e.g. /System/Volumes/Data/Users shows up in /Users). If you change something in a firmlinked directory, the changes are stored on the data volume. If you try to change something in a non-firmlinked directory, it'll fail because it's on a read-only volume (even if SIP is completely disabled).

For more details, see the Ars Technica review of Catalina, the WWDC2019 sesson "What's New in Apple File Systems", and a filesystem map from the Eclectic Light Company.

If you really need to make changes in the content on the read-only system volume, it is possible, but I'd recommend against it if there's an alternative. Most of the things you normally want to change/add/etc can be done from modifiable parts of the filesystem (e.g. using /usr/local instead of /usr). So the rest of this comes with a warning.

Warning: I have not tested this much, and make no promises at all about what the consequences will be (including both immediate consequences, and what happens the next time an OS update changes things). Do you have any important files on this Mac? Do you have a good backup? Do you feel lucky?

[Update: In Big Sur, the system volume is not just read-only, but also signed, so changing it is even more difficult. See "Mount root as writable in Big Sur" for more info.]

To make changes to the normally-read-only volume, you need to both disable SIP's filesystem protection and also re-mount the volume with read access:

  1. Restart in Recovery mode (Command-R at startup), open Terminal (from the Utilities menu), and disable SIP filesystem protection with:

    csrutil enable --without fs
    
  2. Restart normally, open Terminal, and remount the root volume for read access:

    sudo mount -uw /
    

At this point, you should be able to make changes everywhere (subject to normal filesystem protections) up until the next restart. Disabling SIP's filesystem protection survives restarts, but remounting with write access does not. If you want everything to be writable after restarting, you'll have to repeat the sudo mount command after each restart. What I'd recommend, though, is locking everything back down as soon as you've made the necessary changes. To do this, restart in Recovery mode, run csrutil enable, then restart again normally.

14
  • does SIP in any away affects the performance of one's OS? – Sayan Nov 20 '19 at 8:56
  • @Sayan Not that I'm aware of, although I haven't seen anyone test it specifically. I'd expect that if there is any impact, it'd be minimal. – Gordon Davisson Nov 20 '19 at 16:52
  • 1
    If anything disabling SIP should increase performance. (But please don’t take this to mean you should turn off SIP to make your Mac faster, we’re talking infinitesimal differences here.) – Wowfunhappy Feb 13 '20 at 21:37
  • 1
    Also fyi you can make a launchdaemon that runs mount -uw / if you don’t want to retype it at every boot. – Wowfunhappy Feb 13 '20 at 21:39
  • 2
    @WGroleau I think you have the mount points backward. / is the (normally) read-only system volume, and /System/Volumes/Data is the read-write data volume. Also, while you need to disable the filesystem protection part of SIP, fully disabling it is overkill; that's why I recommend csrutil enable --without fs -- it turns on (/leaves on) all SIP protections except the filesystem part. – Gordon Davisson Feb 15 '20 at 23:11
2

Try on normal desktop with sudo mount -uw / it works until restart.

1
  • Good enough for me. All I want to do is create some symlinks like /Photos, /Audio, /Video. Get out of my way Apple. – Sridhar Sarnobat Dec 6 '20 at 5:18
0

Before Catalina I used to have an alias in the root for my /opt. This was a cloud synced folder I could share across my machines to get some command line tools available everyone. When I got my Mac Pro, Catalina was installed and I started struggling with its file system proteciton. Disabling SIP didn't cut it any longer. Also a great surprise showed up: the /opt folder is now part of the OS, which didn't even allow me to use the synthesized file to create faux aliases. I have since renamed that folder to /opts and keep using it like before, and thanks to synthesized I'm able to make it work properly, but WHAT A DRAG...

3
  • If you have other Macs simply install Mojave and be happy. The last at least 5 releases were pure horse shit. I don't understand why Apple doesn't care... But I assume as long as there are 15yo "influencers" falling for every shit we pro users will soon be gone from Mac OS. I know of not a single OS I could use as daily driver, but it HAS to happen soon. Tim Cook fucked up massively. – Julian F. Weinert Dec 13 '20 at 19:15
  • @JulianF.Weinert I am still running Mojave on 2 other macs who support it, but it's slated to be over soon. Been in computing for most of my life, north of 30 years, and I tend to find workarounds to the limits imposed by platform vendors, but gosh is Apple making it hard :D I tend to update Mac OS a year after a release has come, unless I need XCode, which Apple always finds a way to force me into upgrading to use. Unfortunately I can't use Linux as my daily driver because of software, and Windows is, still, a no go (used it for 11 years before switching). I try to stay positive :D – ubi de feo Dec 15 '20 at 7:38
  • I totally agree! Xcode is also doable with copying device support files but yes. They make it harder every time. Good thing you can, I don't know anymore... linux as DD? No way, Windows? Geeesh :D Hope we'll find a way soon :) – Julian F. Weinert Dec 15 '20 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .