Can’t delete file on “/usr/share/file/magic” location

Hi,

I want to delete a file on macOS Ventura 13.2.1 in the location “/usr/share/file/magic”, but I can’t because it has only read permissions. I already tried to disable SIP on Recovery Mode and then deleting it, but it continues to not allowing me to delete it. I also enabled root, disable SIP and tried to delete the file in that location with no success. Anyone knows how can I delete files in that location?


Thank you:


P.S.: I restarted the computer after disable SIP.

MacBook Pro 16″, macOS 13.2

Posted on Feb 27, 2023 10:38 AM

Reply
Question marked as Top-ranking reply

Posted on Feb 27, 2023 11:23 AM

/usr/share/file/magic is stored on the read-only boot volume. SIP does not make the boot volume read/write.


You can only delete things on the read/write Data volume.


Besides /usr/share/file/magic is needed by the 'file' command, and maybe a few other utilities.

Similar questions

12 replies

Feb 27, 2023 1:58 PM in response to 3Onion

I think it was with Catalina 10.15, the boot volume was spit into a read-only partition for macOS install, and a Data partition for user data and files that need to be modified, such as logs, caches, .plist, etc...


Then I would backup your Mac, and "Nuke & Pave" the system via Recover Mode. Then restore your data.


By "Nuke & Pave" I mean totally erase the disk. All partitions, not just a single partition or single volume. The entire drive. Install a clean version of macOS. During initial startup, when asked if you want to transfer data from another Mac, point to your backup disk.


Since Murphy's Law does not care if you have led a good life, make 2 backups, going to 2 different devices, using 2 different backup utilities, so you never have just 1 copy of your data. All of the data restored will end up on the read/write Data partition.

Feb 27, 2023 1:56 PM in response to BobHarris

It seems that Apple has extended the features of the csrutil command to support making changes to the SSV. In outline, I have to boot in Recovery Mode, use the command

csrutil authenticated-root disable

to turn cryptographic verification off, then mount the System volume and perform its modifications. To make that bootable again, I have to bless a new snapshot of the volume using a command such as

sudo bless --folder /[mountpath]/System/Library/CoreServices --bootefi --create-snapshot. After that I should restart.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Can’t delete file on “/usr/share/file/magic” location

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.