9

It looks like changes Apple has made in macOS Catalina make it harder to delete system apps.

I upgraded my work computer to Catalina today (standard Mac mini), and with it came some new (and some old) system apps that I want to get rid of, like the new Podcasts app, Photo Booth, Siri, Apple TV, Music, Chess, Books... I don't want these system apps on my computer.

Ever since macOS El Capitan, I would reboot into recovery mode, run csrutil disable, log back in, and delete away.

It looks like Apple moved their core system apps into /System/Applications, and because that's read-only, you cannot run a sudo rm -rf to delete these applications. When you do, you get the following error (using the Podcast app as an example):

rm: Podcasts.app/Contents/Frameworks/IMUIUtil.framework/Versions: Read-only file system  
rm: Podcasts.app/Contents/Frameworks/IMUIUtil.framework: Read-only file system  
rm: Podcasts.app/Contents/Frameworks: Read-only file system
rm: Podcasts.app/Contents/Info.plist: Read-only file system
rm: Podcasts.app/Contents/PkgInfo: Read-only file system
rm: Podcasts.app/Contents: Read-only file system
rm: Podcasts.app/: Read-only file system

mount returns the following for me:

/dev/disk1s5 on / (apfs, local, read-only, journaled)
devfs on /dev (devfs, local, nobrowse)
/dev/disk1s1 on /System/Volumes/Data (apfs, local, journaled, nobrowse)
/dev/disk1s4 on /private/var/vm (apfs, local, journaled, nobrowse)
map auto_home on /System/Volumes/Data/home (autofs, automounted, nobrowse)

and diskutil list tells me this:

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS Container disk1         1.0 TB     disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +1.0 TB     disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD - Data     30.0 GB    disk1s1
   2:                APFS Volume Preboot                 99.4 MB    disk1s2
   3:                APFS Volume Recovery                528.9 MB   disk1s3
   4:                APFS Volume VM                      2.1 GB     disk1s4
   5:                APFS Volume Macintosh HD            10.6 GB    disk1s5

I don't know where to go from here. How can I make the /System/Applications folder to be writeable so that I can delete the system apps that I don't want/need? I have yet to see any guides on this new issue.

Anyone have any ideas? I don't know how macOS sets its mount points. It doesn't use a standard fstab file anymore, so I can't see where it's mounting things and just set a write-flag.

Improve this question
3

1 Answer 1

Reset to default
9

To do this you must temporarily disable some of the system's best protections against malware, so to play it safe, first make sure your machine is free of malware, disconnected from any network, and that you have a good (tested) full-system backup.

Next, disable System Integrity Protection:

  1. Reboot in Recovery Mode by holding down ⌘+R at boot.
  2. Once you are fully in Recovery Mode, run Terminal by selecting it from the Utilities menu in the menubar.
  3. In Terminal, enter csrutil disable.
  4. Reboot back into a normal boot.

Once you have disabled System Integrity Protection and rebooted, you can remount the boot volume read-write with this command:

sudo mount -uw /

Now you can make the desired changes.

Finally, Don't Forget! Re-enable System Integrity Protection:

  1. Reboot in Recovery Mode by holding down ⌘+R at boot.
  2. Once you are fully in Recovery Mode, run Terminal by selecting it from the Utilities menu in the menubar.
  3. In Terminal, enter csrutil enable.
  4. Reboot back into a normal boot.

Note that the sudo mount -uw / is not persistent across reboots, so you don't need to explicitly undo it. The reboots you did to re-enable SIP already caused the root filesystem to get remount read-only again.

Improve this answer
6
  • This fails with "mount_apfs: volume could not be mounted: Operation not permitted".
    – Russell Davis
    Jun 17, 2020 at 22:43
  • 2
    @RussellDavis Did you disable System Integrity Protection first? Back when I wrote this Answer I didn't include that step because it was clear from the Question that OP already knew to do that first.
    – Spiff
    Jun 17, 2020 at 22:57
  • The OP asked about deleting the apps using rm. I understand that sending apps to the Trash doesn't necessarily stop them from running, thus rm may be necessary. But could one accomplish the same effect by (for example) compressing an .app bundle "in place" to effectively prevent it from being executed? If so, would this have an advantage of allowing one to "reverse course" on a previous decision to remove the app?
    – Seamus
    Jun 25, 2020 at 21:16
  • @Seamus Yes, if you get to the step where I said "Now you can make the desired changes", and your desired changes are to compress one or more of the system apps in place and then delete the uncompressed copies, that's certainly something you could do.
    – Spiff
    Jun 25, 2020 at 23:07
  • 1
    Would you like that as a new question? If so, here on superuser - or askdifferent?
    – Seamus
    Jun 25, 2020 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.