up vote 9 down vote favorite
3
share [g+] share [fb]

I want to delete some files/directories from my Time Machine Partition using rm, but am unable to do so. I'm pretty sure the problem is related to some sort of access control extended attributes on files in the backup, but do not know how to override/disable them in order to get rm to work. An example of the error I'm getting is:

% sudo rm -rf Backups.backupdb/MacBook/Latest/MacBook/somedir
rm: Backups.backupdb/MacBook/Latest/MacBook/somedir: Directory not empty
rm: Backups.backupdb/MacBook/Latest/MacBook/somedir/somefile: Operation not permitted

There are a number of reasons I do not want to use either the Time Machine GUI or Finder for this. If possible, I'd like to be able to maintain the extended protection for all other files (I'd like not to disable them globally, unless I can re-enable once I've done my work).

link|improve this question
80% accept rate
I've gotten closer. First, I needed to disable ACLs on my Time Machine disk. Previously, one would use fsaclctl to do this, but Snow Leopard does not include this. I grabbed a copy of the binary from an older version of OSX and ran this: % sudo fsaclctl -p /Volumes/tmvol -d I then tried to use "sudo rm -rf" to remove a directory, but still ran into issues with some files (though others went away fine). Specifically, it failed on soft links. Very strange. On the plus side, the links take up almost no space. On the negative side, I still have the directories sticking around. – Tim Jul 14 '10 at 16:26
feedback

6 Answers

up vote 8 down vote accepted

I couldn't get Ram/Ame's answer to work (got "operation not permitted" errors), but this worked, using the Time Machine Safety Net "bypass" program:

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/MacOS/bypass rm -rfv /Volumes/[disk]/Backups.backupdb/[path]
link|improve this answer
+1!! This helped me. I didn't even try the others because this looked like "the right way" and indeed, it allowed me to resolve the issue with no further questions. Thanks! – tripleee Feb 28 at 13:59
I created an account just to +1 you. I have been looking for a better solution to this, and this was it. It had been driving me crazy. Thank you. – Cameron Spear May 13 at 21:46
feedback
up vote 1 down vote

There's no need to use ACL tools from an older OS.

Use ls -le to view ACLs and chmod to alter them.

For more info, type man chmod and look under ”ACL Manipulation Options” .

The command to remove all ACLs from a folder hierarchy is:

chmod -R -N foldername
link|improve this answer
1  
Note: This would have worked, had it not been for the "Time Machine Safety Net" mentioned by Eric W. – Arne Stenström Mar 7 at 9:15
feedback
up vote 0 down vote

If you're not executing the command as the user that "owns" the backup, you're going to have a hard time deleting from the command line. I just had this issue with a migration, and we had to ditto the entire Time Machine backup (1tb+) and format the drive before we could get any sort of access to it - and trust me, I tried everything to override the permissions.

link|improve this answer
sudo should give me access to all files as I'm running as administrator. I'm pretty sure this is an ACL issue and I'm working on that. – Tim Jul 13 '10 at 15:09
feedback
up vote 0 down vote

If you want to delete all files in a folder and not just specific files, you can accomplish this by adding the folder to Time Machine's exclusion list. (System preferences -> Time Machine -> Options. Drag the folder here.)

Next time you perform a backup, copies of that folder will be removed from previous backups.

Now, if you really want to do this from a CLI, there's a way, albeit a little cumbersome.

  1. Make a backup of /Library/Preferences/com.apple.TimeMachine.plist
  2. Copy /Library/Preferences/com.apple.TimeMachine.plist somewhere where you can toy with it.
  3. Cd into whereever you put it.
  4. Execute
    plutil -convert xml1 com.apple.TimeMachine.plist
    to convert it from binary form.
  5. Open the converted plist in preferable text editor, search for "skippaths"
  6. Insert a new line in that section, formatted as <string>/Path/To/Exclude</string>
  7. Save and exit, convert back by executing
    plutil -convert binary1 com.apple.TimeMachine.plist
  8. Copy your edited plist back into /Library/Preferences/
  9. Start a backup by executing
    /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper -auto

Edit: When you perform step 9, all copies of the newly excluded folder will be erased from previous backups.

To remove the exception, copy your backup back into /Library/Preferences.

link|improve this answer
I'm not trying to exclude a directory. I'm trying to delete a directory from an existing backup and to do some from the commandline. Really, I'd just like to figure out how to allow rm to work within a Backups.backupdb directory. – Tim Jul 12 '10 at 20:30
OK, perhaps it wasn't clear from my instructions that the folder is actually deleted from the backups when performing the above steps. See my edit. But if it's not the solution you are looking for, then I suppose you could always su - root and then rm -rf the folders, but I think fiddling with something as precious as backups in that way is something one should generally try to avoid. – Frost Jul 13 '10 at 6:27
But adding it as an exclusion would delete all copies of it from all the backups. Also, though this is a TimeMachine backup, it is not from the machine that I'm doing this work on, so it is no longer an active TimeMachine. sudo has the same effect as "su - root" and then "rm -rf". I'm pretty sure this is failing because Apple has added a level of security to the filesystem beyond simple *nix permissions. – Tim Jul 13 '10 at 15:11
This might sound stupid, but I'm not entirely sure that sudo has the same effect as su - root on a mac. I seem to recall an occasion when I was trying to delete something where sudo didn't suffice, but sudo - root did the trick. – Frost Jul 14 '10 at 12:58
For completeness sake, I did "su -" and confirmed that the files still could not be deleted. And considering the number of times that the "stupid" idea turned out to be correct, I'd never discount them without trying. – Tim Jul 14 '10 at 15:41
show 2 more comments
feedback
up vote 0 down vote

You can make ls list extended attributes in a long view using the -@ flag. It will list ACLs when you supply the -e flag. So, you can find out what you're dealing with by using ls -lea@ DIR.

Judging by my local Time Machine backups, it looks like Time Machine applies extended attributes with metadata about the newest and oldest snapshots. The data stored by the xattrs looks to be a binary plist. These seem innocuous.

Time Machine also looks to apply ACLs to certain directories it knows about, such as the ones placed in a standard user directory. There are two kinds of ACLs potentially standing in your way: those applied directly to the file or directory that deny delete, and those applied to a parent of the file that deny delete_child.

Unfortunately, Mac OS X does not supply the user utilities getfacl and setfacl specified by POSIX.2c to view and manipulate ACLs. To mess with ACLs, you'll have to do some programming; see the acl(3) manpage.

link|improve this answer
feedback
up vote 0 down vote

Using sudo chmod -R -N folder to remove all ACLs from a folder hierarchy doesn't work on the files and folders in Time Machine's Backups.backupdb, because of the TM Safety Net mechanism and the criteria described in this 318 Tech Journal post (but possibly not exactly as described).
    (Before learning this from looking up the Safety Net mentioned in Eric W's answer (which works), I had only tested on a folder cloned from a subfolder of a TM backup, and there chmod worked. But trying chmod on a folder in an actual TM backup gives the "Operation not permitted" error.)

Of possible use:
    In Mac OS 10.7+, there's a tmutil command (which I haven't tried, since I'm still on Snow Leopard). It has a delete verb, which according to the description "can delete snapshots from backups that were not made by, or are not claimed by, the current machine" (where a "snapshot" is a dated folder representing a single incremental backup). It isn't clear to me if this means that it can't delete snapshots which are made by or claimed by the current machine.(?)

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.