removing/editing read only file system

even after disabling SIP , i still can't remove ARDAgent.app

is there a way to remove this

rm: /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support: Read-only file system

rm: /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Info.plist: Read-only file system

rm: /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/PkgInfo: Read-only file system

rm: /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/version.plist: Read-only file system

rm: /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents: Read-only file system

MacBook Air 13″, macOS 12.6

Posted on Jun 8, 2023 11:32 PM

Reply
Question marked as Top-ranking reply

Posted on Jun 9, 2023 1:51 AM

A good thing for Apple , Ok Here a lesson For you, so only answer questions in maybe more respectful way or if you don't know then maybe learn:


these are used for RemoteManagement services are used by apple and Whoever can escalate permissions("privileges") from either locally or remotely, i have been noticing that that ARD agent and SSMenu Agent running while i'm not running them or even using it, and when i kill and stop it .


later in few days, start working then discovered that there's SSH connection ("hacked")masked into a DNS Tunnel running on UDP , which makes traffic not only hidden from firewall but also very hard to trace.


this's why i want to delete following from CoreServices , so even if someone has ssh connection into my osx can't use these service to view and manage remotely

ARDAgent.app       

AppleVNCServer.bundle   

SSMenuAgent.app      

ScreensharingAgent.bundle

screensharingd.bundle


So if anyone facing same issue :

  1. recovery mode
  2. Turn off SIP (csrutil) and Restart
  3. turn off SIP root-auth (csrutil Auth-root) and restart ( file-vault must be off)
  4. check your os volumes usingdiskutil
  5. remount OS and OS data apfs (volumes ) as writeable
  6. check mount is writable (mount)
  7. delete files and turn on sip and root auth restart into your os

Similar questions

19 replies

Jun 9, 2023 1:28 AM in response to laith188

You cannot remove these files, and that is a good thing!


Why on earth would you try such a thing? You could damage your system to the point that your mac might not even boot.


Anything under /System is mounted in a readonly volume, for security. This prevents tampering with the OS.

There is NO reason why anyone would need to delete or change these files other than Apple.



Jun 9, 2023 9:38 PM in response to laith188

Beginning with macOS 10.15 Catalina, Apple separated the macOS system files from user data. Apple now places the macOS system files onto a read-only APFS volume.

About the read-only system volume in macOS Catalina or later - Apple Support


And beginning with macOS 11.x Big Sur, Apple then made the read-only system volume a signed & sealed volume so that you can be sure nothing is modifying the core system files.

Signed system volume security in iOS, iPadOS, and macOS - Apple Support


What is a signed system volume? - Apple Support


I can appreciate you want to minimize the area for potential issues & vulnerabilities, but macOS is not an OS you can do this with. In fact macOS does not like being modified too far from system defaults (personal experience & also reading these forums). macOS has great built in security especially when the user also practices safe computing habits such as those outlined in this excellent article written by a respected forum contributor (also includes tips to keep the OS running smoothly). While I'm sure you may be already be aware of these safe computing habits, I'm including it here for others who read this thread and want to better understand how to keep their Mac secure & running smoothly.

Effective defenses against malware and other threats - Apple Community


If you want an OS you can customize, then you may want to learn & use Linux or one of the BSDs such as FreeBSD. I was able to customize a Linux installation to only use about 70MB of memory when booted to the Desktop (typically most default Linux distributions' graphical Desktop Environment installs utilize 400MB+ of RAM)....yes it had a very basic graphical interface, but I did lose out on some automated features (not a problem for me). I don't recall how much storage space it took up on the drive, but it wasn't much. Even with Linux, some higher end features may pull in a lot of support libraries and projects. But if you want to customize the OS as you are describing here, then a Linux distribution or one of the BSDs are your best options to do so.


Any unusual customization that macOS used to allow is slowly being removed or broken with each new macOS update & upgrade. macOS is becoming more & more like iOS so expect this trend to continue....even the Mac computer hardware is moving that way too. Some of it is motivated by enhancing security and to make the OS more stable for a better user experience. Part of it is to also keep users from accidentally removing a critical part of the OS. I'm sure other motivations are also involved with some of these changes.


Sep 22, 2023 11:34 AM in response to AlexGreggs2

AlexGreggs2 wrote:

FINALLY!!! I have had the same issue. I have been using macs for over 30 years and the last few months have been **** dealing with something or someone getting into my machine. The processes you listed are the exact same ones that I have noticed being the common denominator. It's not a bug or a corrupted plist file. The damage is too deliberate and targeted to a specific project I am working on.

I am going to try what you suggested


Do whatever you like, it is your mac, but if you start messing around with files that Apple includes as part of the OS you may risk making your mac unbootable. There are thousands of processes running at any time in macOS (or any other OS, for that matter). Most users have no idea what they are. Deleting files left and right is unlikely to fix the issues you are facing, and could have devastating effects. At the very least, make a full backup of your data because embarking on this adventure. Just saying.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

removing/editing read only file system

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.