MacOS – How to prevent user from moving a custom app to Trash

applicationsmacostrash

I am building an OS X Cocoa app for an administrator who doesn't want the user to remove the app by moving it to Trash. This is not going to be on the App Store.

  1. How does Apple prevent users from deleting App Store or Chess app etc.? Can the same logic be used for third party apps?

Best Answer

Apple adds an access control entry to some apps, that denies delete access to the "everyone" group:

$ ls -lde /Applications/App\ Store.app
drwxr-xr-x+ 3 root  wheel  102 Feb 16 22:21 /Applications/App Store.app
 0: group:everyone deny delete

However, if the user you're trying to keep from deleting this is an administrator, they can remove ACLs, and then delete things freely. Admins can also remove or disable launch daemons. Basically, if someone has admin rights on the computer, they can get around your attempts to lock things down. See this previous question where CommaToast makes a valiant effort at figuring out how to lock something down against an opponent with admin rights... but I can still think of ways around his measures.

On the other hand if they're not an admin, then it's trivial: they can't delete things from /Applications anyway.

Related Question