man ls list what the result of -l contains and lists them in order, except the it doesn't mention what appears between group and size.

Usually it is just a hyphen, but there is a disk image in my Trash that can't be deleted, which has "restricted" in that spot. The word restricted is not anywhere in the man page.

The .dmg is not mounted, and is owned by root. sudo also can't remove it and can't change the owner, even though it has no ACL nor extended attributes.

It's not due to the ACL on the Trash—if I drag it to desktop, I still can't delete it with sudo rm

And the diagnostic when I try either delete method is that it is "in use" but ps -ef and Finder say that's not true (name not in ps and image not mounted).

All of this is still true after a reboot!

  • Can you add an example of the output from ls? Commented Aug 14, 2022 at 19:34
  • The information you see in your output is not related to ˋls -lˋ. Why not include the actual command and it‘s result so people don‘t get misled by missing information?
    – nohillside
    Commented Aug 14, 2022 at 20:17
  • I haven't read the 'community review', and the editing queue on the OP's question is already overflowing with suggestions, so it feels stupid to add another edit attempt. Clearly the user did a ls -lO and not just ls -l as it somehow implied or perceived — but the overall question, while possibly benefitting from a rewrite for clarity, surely does not need to be closed; IMHO, there is no need to be that picky, downvoting the question, and, after six months, closing the question, keeping the edit reviews on the queue, etc. etc. etc. The question is relevant. Commented Feb 24, 2023 at 20:58
  • Also, keep in mind that users with a generous understanding of POSIX-compliant shells on other operating systems, coming to macOS, have a certain degree of expectations — which macOS does not always fulfil. The way the OP wrote the question shows a working understanding of what he's trying to attempt. He did RTFM — it's just that Apple is not fond of documenting things at a very low level for 'common' users (who nevertheless will know how to use sudo to wreak havoc — so Apple makes it as hard as they can). Commented Feb 24, 2023 at 21:02
  • Or, if you wish: The question comes from the perspective of someone who goes 'WTF?' when suddenly realising that macOS — like everything else at Apple! — has been subjected to the Reality Distortion Field. Things are not as they seem to be; things are not fully documented as they should be; what you get is not what you expect (just by being a macOS 'superuser' doesn't mean you have full access to everything on your hardware!). In fact, discovering how macOS differs so much (conceptually speaking, that is) from other BSD derivatives (or even Linux...) is an education in itself! Commented Feb 24, 2023 at 21:05

2 Answers 2


The field that optionally appears in ls output between group and size is the file flags when enabled with the -O option with -l output.

This is documented in the ls manpage:

-O Include the file flags in a long (-l) output.

The fields are, in order: inode, block count, number of links, user name, group name, flags, file size, file name.

And from the chflags manpages:

       arch, archived
               set the archived flag (super-user only)

       opaque  set the opaque flag (owner or super-user only).  [Directory
               is opaque when viewed through a union mount]

       nodump  set the nodump flag (owner or super-user only)

       sappnd, sappend
               set the system append-only flag (super-user only)

       schg, schange, simmutable
               set the system immutable flag (super-user only)

       uappnd, uappend
               set the user append-only flag (owner or super-user only)

       uchg, uchange, uimmutable
               set the user immutable flag (owner or super-user only)

       hidden  set the hidden flag [Hide item from GUI]
  • 1
    That and fd0’s explanation of "restricted" (which is missing from man chflags) answers the question.
    – WGroleau
    Commented Aug 14, 2022 at 22:12

"restricted" is a file flag produced by Apple's System Integrity Protection, mentioned in /usr/include/sys/stat.h. Here's a link on how to disable and enable SIP- https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection

  • Bummer. I've had to do that for other things, and it's proctalgia. Especially when it's something that is un-done by every software update.
    – WGroleau
    Commented Aug 14, 2022 at 22:09
  • 1
    Aha! — moved the containing directory to /private/tmp and let the next reboot delete it!
    – WGroleau
    Commented Aug 14, 2022 at 22:34
  • @WGroleau that sometimes works... iff you can move the containing directory at all. In my case, I have one directory containing 'restricted' files which refuses to be moved anywhere. Commented Feb 24, 2023 at 20:50
  • Can you relocate anything important from the parent directory, and then move that to /tmp ?
    – WGroleau
    Commented Feb 25, 2023 at 5:14

Not the answer you're looking for? Browse other questions tagged .