File can't be moved by root on OS X

I tried to move a few files to a subfolder on OS X. One refused to move. It said Operation not permitted. I tried again as root:

$ sudo mv file subfolder/
mv: rename file to subfolder/file: Operation not permitted
$ sudo mv file filex
mv: rename file to filex: Operation not permitted
$ lsattr file
lsattr: Inappropriate ioctl for device While reading flags on file

I tried lsattr on other files; all files I tried gave me the same message: Inappropriate ioctl for device While reading...

Coming from Linux, I did not know about flags so here is the output of ls -leO@ file:

$ ls -leO@ file otherfile
-rwxrwxrwx  1 eeytan  staff  uchg 79549 Nov 11  2010 file
-rw-r--r--  1 eeytan  staff  -     5071 Sep  7 02:37 otherfile

I tried the OS X Disk Utility; it said there were no errors on my disk. What's going on here?


Solution 1:

Sounds like the file is locked to me, which is why the uchg attribute is appearing. You should be able to use the following command to remove the locked attribute:

chflags nouchg file

or right-click the file in the Finder, click "Get Info" then uncheck the "Locked" checkbox

Solution 2:

For people stumbling upon this in an OS X 10.11+ era (El Capitan or newer): Apple has added a whole new layer of security in OS X. They have taken away some privileges from root. The file you are trying to modify has a restricted flag. Only restricted processes which are signed by Apple will be able to modify these files. However, you can disable this security system by booting in recovery mode and disabling it in a Terminal by doing: csrutil disable.

Alternatively, you can also just start Terminal in Recovery Mode and delete the file there. Or even try booting in a Linux environment with HFS+ support (at least if you're not on APFS yet) to change the file.

Solution 3:

Try:

chflags -f -R nouchg directory

on a higher level directory to stop this problem.