18

I'm trying to copy under root file into /System folder. It works well on all previous OS X version but not on El Capitan 10.11

Here how I copy file under root in terminal:

MACMINI:~ myusername$ sudo su -
MACMINI:~ root# cp /Users/myusername/Desktop/myfile.plist /System/Library/LaunchDaemons/

As result I receive an error:

cp: /System/Library/LaunchDaemons/myfile.plist: Operation not permitted

3 Answers 3

40

El Capitan now protects certain system directories in "rootless" mode (a.k.a. System Integrity Protection). If you run the command ls -lO /System/Library/LaunchDaemons you'll see that the directories and files under there are now marked as "restricted."

You can disable rootless mode like this:

  1. Reboot into recovery mode (reboot and hold down Cmd-R)
  2. Open a terminal
  3. Use this command: csrutil disable
  4. Reboot and run the command that worked prior to El Capitan

When you're done, it is highly recommended that you re-enable SIP by following the same steps, but using csrutil enable in step 3.

I ran into a problem with the same root cause while trying to get pear/pecl modules and macports/homebrew apps installed. Those typically need to install files into /usr/include and /usr/lib, which are also now restricted.

Note: Previous answers around the Internet about this problem give you instructions for modifying NVRAM settings, but Apple stated that the NVRAM method would stop working with El Capitan's public release. The GM release has already disabled the NVRAM workaround, so this answer should get you what you need moving forward.

UPDATE: This same method is applicable to macOS Sierra, and probably new macOS versions for the foreseeable future.

ANOTHER UPDATE! It looks like Catalina's trying to do us in. They moved all the files I had previously forced to go where the Linux stuff had to go: Contents of /Users/Shared/Relocated Items

And they left this funny notice: What Are Relocated Items.pdf I'm kind of wondering whose computer I'm using now.

At any rate, I think most of the tools like brew and PEAR that used to need this workaround have adapted. I don't really know because making macOS behave 100% like Linux has become silly, so I use VMs when I need command line Linux things.

This workaround may still do the trick with Catalina. I haven't tried. I'm not going to do so for the sake of research, but I'll report back if I have a need to give it a shot.

2
10

Considering that certain system directories are protected from being written at all (even with root) under OS X 10.11 (El Capitan) unless security measurements are disabled (see answer by Chris Ostmo) it's obviously a good idea to not modify those directories at all with custom system hacks.

Own LaunchDaemons should be installed to:

/Library/LaunchDaemons/

(not /System/Library/LaunchDaemons/)

3
  • Correct. Similarly, local libraries should go in /usr/local/lib, /usr/local/include, etc (which are not restricted), not into /usr/lib etc (which are restricted). Basically, if you install your local customizations in the right place, you shouldn't need to turn off system integrity protection. Sep 18, 2015 at 18:52
  • The problem that I ran into that necessitated this workaround was not "custom system hacks." To perform my job, I need to run common Linux/Unix utilities, and many of them have installed their supporting files in /usr/lib and /usr/include for decades. Fortunately, you can turn SIP off, install those things that need access, then turn SIP back on (only allow the exception if you know what's being installed and why, then reinstate the controls). But I do agree that, if it is a "custom system hack," you should abide by the OS restrictions :-) Sep 23, 2015 at 23:47
  • Yes, abiding the system rules can be tricky at times. F.ex. I had installed bunch of ruby gems which install their binary wrapper into "/usr/bin" by default on Yosemite. I had no idea the gem installer did that (not a Ruby person myself), so in preparation of a possible update to El Capitan I tweaked the default gem config, so it will install to "/usr/local/bin" in the future and moved the already existing files manually out of "/usr/bin" — just to be on the safe side. :)
    – Haru
    Sep 25, 2015 at 1:01
0

No, but if you use 2nd copy of El Captain to boot your system, for example:

Boot El Captain from a previous installation on a usb key, then you can do this

cd /Volumes/Usb-Drive 

Then to show the directory in finder do this:

sudo chflags nohidden usr

Then just copy the files with your mouse, drag and drop into finder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.