How to Remove a File from a Protected Folder in macOS Mojave

foldersitermmojavesoundflowerterminal

Background

I am trying to remove Sound Flower from my Mac. I found some relative files in 3 places. I removed 2 of them but the third one is in a folder that will not allow me to remove it.

Example

The file is in,

/Library/SystemMigration/History/Migration-1C2FCFF8-A394-409D-8DB3-E7885C0D5E81/QuarantineRoot/Library/StagedExtensions/Library/Extensions

The file name is,

Soundflower.kext

When I try to remove it like this,

rm -rf Soundflower.kext

I get this error!

rm: Soundflower.kext/Contents/_CodeSignature/CodeResources: Operation
not permitted rm: Soundflower.kext/Contents/_CodeSignature: Operation
not permitted rm: Soundflower.kext/Contents/MacOS/Soundflower:
Operation not permitted rm: Soundflower.kext/Contents/MacOS: Operation
not permitted rm: Soundflower.kext/Contents/Info.plist: Operation not
permitted rm: Soundflower.kext/Contents: Operation not permitted rm:
Soundflower.kext: Operation not permitted

I have tried, sudo, sudo su and adding the Terminal and iTerm to
Full Disk Access

settings in Security & Privacy in system settings. Once I added them I closed and restarted my terminals.

I still get the error.

Question

How do I remove this file from the path mentioned above?

Best Answer

You can remove the file without disabling SIP by booting to Recovery and then deleting the file in the terminal. The system disk is actually mounted read/write in Mojave Recovery, so the trick is that you have to refer to the drive by starting at /Volumes/yourdrivenamehere. So in this case the command to remove the file would be:

rm -rf /Volumes/yourdrivenamehere/Library/SystemMigration/History/Migration-1C2FCFF8-A394-409D-8DB3-E7885C0D5E81/QuarantineRoot/Library/StagedExtensions/Library/Extensions/Soundflower.kext