9

It looks like changes Apple has made in macOS Catalina make it harder to delete system apps.

I upgraded my work computer to Catalina today (standard Mac mini), and with it came some new (and some old) system apps that I want to get rid of, like the new Podcasts app, Photo Booth, Siri, Apple TV, Music, Chess, Books... I don't want these system apps on my computer.

Ever since macOS El Capitan, I would reboot into recovery mode, run csrutil disable, log back in, and delete away.

It looks like Apple moved their core system apps into /System/Applications, and because that's read-only, you cannot run a sudo rm -rf to delete these applications. When you do, you get the following error (using the Podcast app as an example):

rm: Podcasts.app/Contents/Frameworks/IMUIUtil.framework/Versions: Read-only file system  
rm: Podcasts.app/Contents/Frameworks/IMUIUtil.framework: Read-only file system  
rm: Podcasts.app/Contents/Frameworks: Read-only file system
rm: Podcasts.app/Contents/Info.plist: Read-only file system
rm: Podcasts.app/Contents/PkgInfo: Read-only file system
rm: Podcasts.app/Contents: Read-only file system
rm: Podcasts.app/: Read-only file system

mount returns the following for me:

/dev/disk1s5 on / (apfs, local, read-only, journaled)
devfs on /dev (devfs, local, nobrowse)
/dev/disk1s1 on /System/Volumes/Data (apfs, local, journaled, nobrowse)
/dev/disk1s4 on /private/var/vm (apfs, local, journaled, nobrowse)
map auto_home on /System/Volumes/Data/home (autofs, automounted, nobrowse)

and diskutil list tells me this:

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS Container disk1         1.0 TB     disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +1.0 TB     disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD - Data     30.0 GB    disk1s1
   2:                APFS Volume Preboot                 99.4 MB    disk1s2
   3:                APFS Volume Recovery                528.9 MB   disk1s3
   4:                APFS Volume VM                      2.1 GB     disk1s4
   5:                APFS Volume Macintosh HD            10.6 GB    disk1s5

I don't know where to go from here. How can I make the /System/Applications folder to be writeable so that I can delete the system apps that I don't want/need? I have yet to see any guides on this new issue.

Anyone have any ideas? I don't know how macOS sets its mount points. It doesn't use a standard fstab file anymore, so I can't see where it's mounting things and just set a write-flag.

Spiff
  • 101,729
  • 17
  • 175
  • 229
jasonmclose
  • 193
  • 1
  • 1
  • 5
  • 2
    [Catalina’s read-only system volume](https://arstechnica.com/gadgets/2019/10/macos-10-15-catalina-the-ars-technica-review/11/) –  Oct 08 '19 at 17:31
  • 2
    I see this as nothing different than a cell company putting apps on a phone that cannot be removed. It's my computer. If I want to take apps off of it, I should be able to do so, and it shouldn't take a workaround. – jasonmclose Oct 09 '19 at 18:11
  • [How to make root volume writeable again in Catalina?](https://apple.stackexchange.com/questions/371908/how-to-make-root-volume-writeable-again-in-catalina/372000#372000) –  Oct 09 '19 at 20:53

1 Answers1

9

To do this you must temporarily disable some of the system's best protections against malware, so to play it safe, first make sure your machine is free of malware, disconnected from any network, and that you have a good (tested) full-system backup.

Next, disable System Integrity Protection:

  1. Reboot in Recovery Mode by holding down ⌘+R at boot.
  2. Once you are fully in Recovery Mode, run Terminal by selecting it from the Utilities menu in the menubar.
  3. In Terminal, enter csrutil disable.
  4. Reboot back into a normal boot.

Once you have disabled System Integrity Protection and rebooted, you can remount the boot volume read-write with this command:

sudo mount -uw /

Now you can make the desired changes.

Finally, Don't Forget! Re-enable System Integrity Protection:

  1. Reboot in Recovery Mode by holding down ⌘+R at boot.
  2. Once you are fully in Recovery Mode, run Terminal by selecting it from the Utilities menu in the menubar.
  3. In Terminal, enter csrutil enable.
  4. Reboot back into a normal boot.

Note that the sudo mount -uw / is not persistent across reboots, so you don't need to explicitly undo it. The reboots you did to re-enable SIP already caused the root filesystem to get remount read-only again.

Spiff
  • 101,729
  • 17
  • 175
  • 229
  • This fails with "mount_apfs: volume could not be mounted: Operation not permitted". – Russell Davis Jun 17 '20 at 22:43
  • 2
    @RussellDavis Did you disable System Integrity Protection first? Back when I wrote this Answer I didn't include that step because it was clear from the Question that OP already knew to do that first. – Spiff Jun 17 '20 at 22:57
  • The OP asked about deleting the apps using `rm`. I understand that sending apps to the `Trash` doesn't necessarily stop them from running, thus `rm` may be necessary. But could one accomplish the same effect by (for example) compressing an .app bundle "in place" to effectively prevent it from being executed? If so, would this have an advantage of allowing one to "reverse course" on a previous decision to remove the app? – Seamus Jun 25 '20 at 21:16
  • @Seamus Yes, if you get to the step where I said "Now you can make the desired changes", and your desired changes are to compress one or more of the system apps in place and then delete the uncompressed copies, that's certainly something you could do. – Spiff Jun 25 '20 at 23:07
  • 1
    Would you like that as a new question? If so, here on superuser - or askdifferent? – Seamus Jun 25 '20 at 23:22
  • @Seamus It doesn't make any difference to me. – Spiff Jun 26 '20 at 02:57