MacOS – Why can’t I change a restricted System file after doing csrutil disable

macos

I want to change a file in /System/Library/Input Methods/PressAndHold.app/Contents/Resources/, but even after disabling csrutil in recovery mode, I still get this flags with -ls -lO <filename>:

-rw-r–r– 1 root wheel restricted, compressed 6365 23 Aug 03:55 Keyboard-de.plist

UPDATE: I just figured out that I can change the ownership, so I should be able to cp and rm the file I want to change.
Still, when I am opening the file with TextEdit, I can't do anything, but I think this should be possible too.

EDIT: To check if SIP is still on, type csrutil status in the terminal. With SIP on it's impossible to change those files as any user.

sudo nano worked just fine. Thanks for all the help!

Best Answer

The restricted flag only applies with System Integrity Protection enabled. It tells SIP which files to protect. If you disable SIP, the restricted flag has no effect.

Disabling SIP doesn't give you permission to the files though. You'll still need sudo or change the permissions yourself to edit the files.

Related Question