Removing "rw-r--r-- root/wheel restricted" files in macOS leave some files left

Question

I've just discovered a 4.5Gb /Previous System/private directory, caused by a (recent) upgrade to 10.13 (the dates seems to match). Since it weighs heavily on my available space and I don't know why would the update decide to keep around a bunch of system-level files, I've tried to rm -Rf it. This mostly succeeded (shrank to 1.6Gb), but still have some files which I am not able to delete, under var/dyld and var/datadetectors.

Here's the output of a sudo rm -Rf /Previous\ System :

rm: datadetectors: Permission denied
override rw-r--r--  root/wheel restricted for dyld/dyld_shared_cache_x86_64.map?

I'm under the impression the restricted relates to SIP ? I can't figure why it would protect /Previous System since that's not in use though…

Does the path to free space recovery entails a SIP-reboot dance, for something unrelated to my currently running system ?

Solution

The /Previous System directory is created as a result of you performing an Archive and Install installation of the Mac OS at some time. When you did that, the installer placed a variety of system files—preference files, fonts, and plug-ins among them—in this Previous System folder. You can’t boot your Mac from this folder, it’s there simply for the storage of old system files.

SIP may be preventing you from deleting some of these files. Normal caveats of proceeding at your own risk apply.

You can disable System Integrity Protection.

• Reboot into Recovery (⌘ + R (or option + ⌘ + R if csrutil isn't present))
• Enter csrutil disable in a Terminal window
• Reboot

You should now be able to remove those files.

I'd strongly suggest repeating the above sequence to re-enable SIP (csrutil enable) after your done cleaning up.

Comments

[Tony Mai]

You can also temporarily disable SIP the following way: stackoverflow.com/a/32910408/11011232 ---------------------------------------------

[tiennou]

I was mostly really surprised that /Previous System happens to be covered by SIP (which I can't see why it matters from a security standpoint). It also seems to be part of some restoration system as well, since it seems to be an OS failsafe — when does it get used then? On top of this it appeared as "the result of an upgrade", and a novice user would have no way to reclaim the lost space. Also, that seemed a good question, and I dislike reboots 😉.