Macos – How to delete system apps in macOS Catalina

bloatwarefstabmacosmacos catalinamount

It looks like changes Apple has made in macOS Catalina make it harder to delete system apps.

I upgraded my work computer to Catalina today (standard Mac mini), and with it came some new (and some old) system apps that I want to get rid of, like the new Podcasts app, Photo Booth, Siri, Apple TV, Music, Chess, Books… I don't want these system apps on my computer.

Ever since macOS El Capitan, I would reboot into recovery mode, run csrutil disable, log back in, and delete away.

It looks like Apple moved their core system apps into /System/Applications, and because that's read-only, you cannot run a sudo rm -rf to delete these applications. When you do, you get the following error (using the Podcast app as an example):

rm: Podcasts.app/Contents/Frameworks/IMUIUtil.framework/Versions: Read-only file system  
rm: Podcasts.app/Contents/Frameworks/IMUIUtil.framework: Read-only file system  
rm: Podcasts.app/Contents/Frameworks: Read-only file system
rm: Podcasts.app/Contents/Info.plist: Read-only file system
rm: Podcasts.app/Contents/PkgInfo: Read-only file system
rm: Podcasts.app/Contents: Read-only file system
rm: Podcasts.app/: Read-only file system

mount returns the following for me:

/dev/disk1s5 on / (apfs, local, read-only, journaled)
devfs on /dev (devfs, local, nobrowse)
/dev/disk1s1 on /System/Volumes/Data (apfs, local, journaled, nobrowse)
/dev/disk1s4 on /private/var/vm (apfs, local, journaled, nobrowse)
map auto_home on /System/Volumes/Data/home (autofs, automounted, nobrowse)

and diskutil list tells me this:

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS Container disk1         1.0 TB     disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +1.0 TB     disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD - Data     30.0 GB    disk1s1
   2:                APFS Volume Preboot                 99.4 MB    disk1s2
   3:                APFS Volume Recovery                528.9 MB   disk1s3
   4:                APFS Volume VM                      2.1 GB     disk1s4
   5:                APFS Volume Macintosh HD            10.6 GB    disk1s5

I don't know where to go from here. How can I make the /System/Applications folder to be writeable so that I can delete the system apps that I don't want/need? I have yet to see any guides on this new issue.

Anyone have any ideas? I don't know how macOS sets its mount points. It doesn't use a standard fstab file anymore, so I can't see where it's mounting things and just set a write-flag.

Best Answer

To do this you must temporarily disable some of the system's best protections against malware, so to play it safe, first make sure your machine is free of malware, disconnected from any network, and that you have a good (tested) full-system backup.

Next, disable System Integrity Protection:

  1. Reboot in Recovery Mode by holding down ⌘+R at boot.
  2. Once you are fully in Recovery Mode, run Terminal by selecting it from the Utilities menu in the menubar.
  3. In Terminal, enter csrutil disable.
  4. Reboot back into a normal boot.

Once you have disabled System Integrity Protection and rebooted, you can remount the boot volume read-write with this command:

sudo mount -uw /

Now you can make the desired changes.

Finally, Don't Forget! Re-enable System Integrity Protection:

  1. Reboot in Recovery Mode by holding down ⌘+R at boot.
  2. Once you are fully in Recovery Mode, run Terminal by selecting it from the Utilities menu in the menubar.
  3. In Terminal, enter csrutil enable.
  4. Reboot back into a normal boot.

Note that the sudo mount -uw / is not persistent across reboots, so you don't need to explicitly undo it. The reboots you did to re-enable SIP already caused the root filesystem to get remount read-only again.