Catalina Upgrade Cannot Delete Relocated Items

As this questi9on has had over 1k views, it seems it is a common issue. Therefore, I thought I would outline what I did to get it resolved in case others find it useful.

When I first tried to remove the link, I was told the operation was not permitted. Looking at the link, I could see it was owned by 'root' and in the 'wheel' group. I therefore then tried to remove it with sudo i.e.

sudo unlink X11

This failed with the same error. I also tried

sudo rm -rf X11

but this also failed with the same error. I then posted here asking for help and @Danijel-JamesW added a comment with a link to a useful article which provided some background on the new security features initially introduced in the previous version of macOS, but extended in Catalina. One of the things this article highlights is that some applications, like terminals and editors (in my case Emacs), need to have the full disk access privilege. Without this privilege, you will often get operation not permitted errors in unexpected locations/situations. Unfortunately, this was not the issue in my case. My terminal app (iTerm2.app) had the necessary permissions. However, the article did indicate that you could also get around the operation not permitted error by disabling SIP (System Integrity Protection). This was going to be my next move. However, in the end it was not necessary.

Thanks to a comment from @user3439694 I found out that you can boot into recovery mode and use the terminal to delete the file. THis is what I did

1. Boot holding down commmand + R
2. Click on Utilities and select Terminal from the top menu
3. Enter rm -rf /path/to/file/to/remove
4. Reboot

This solved my issue. One important thing to note is that working in the recovery terminal is powerful and potentially dangerous. You need to make sure you are deleting what you mean to delete. To be extra safe, instead of immediately issue the rm command, you can use ls -l to make sure you have the correct file or directory and then hit the up arrow to bring back the command from the history, move to the beginning of the line, remove the ls -l and type rm -rf, leaving the path unmodified following the rm -rf. Note also that the -r means recursive and -f means force - very powerful and dangerous. It will essentially remove everything from the point specified in the path downwards i.e. all sub directories and files. So, if you get that path wrong, you may end up deleting much more than you expected to. In my case, the path I needed was

/Volumes/Macintosh\ HD\ -\ Data/Users/tim/Desktop/Relocated\ Items

my login account is 'tim'. the '\ ' are needed to escape the spaces in the path. Most systems will have the path starting with /Volume, but the drive name may differ (i.e. Macintosh HD). the '- Data' is fairly standard.

Anyway, this fixed the issue and those irritating files are now gone and my Desktop folder is clean (for now!).

I used the procedure found at MacReports.com:

• boot into Recovery Mode,
• disable csrutil,
• reboot,
• delete the folder (in either the Finder or Terminal),
• reboot into Recovery Mode,
• re-enable csrutil; and,
• reboot.

Four reboots (!), yes -- but so far, so good.

The issue is caused by X11 symlink which is setup by XQuartz and this points to X11 folder which is protected by Mac OSX. At some point you might have installed XQuartz and the original procedure is to uninstall XQuartz and reinstall XQuartz after Catalina upgrade.

In my case, I had installed XQuartz via homebrew cask and had already upgraded to catalina. So firstly, uninstall XQuartz.

$ brew cask ls
$ brew cask remove xquartz

• now restart your mac
• hold "cmd + r" (you can release the keys after a few seconds just after apple logo appears with the progress bar)
• now you are in recovery mode
• select from the top menu utilities > terminal
• enter the following to disable apple secure integrity

$ csrutil disable       # this disables apple secure integrity tool 

• close the terminal
• select from the top menu restart and wait for normal boot into your account
• now you can delete the files which are stuck and bin them as usual
• for completness, reboot into the recovery mode as above steps and in the terminal enter

$ csrutil enable       # this reenables apple secure integrity tool

• restart and login as usual

if you are freaking out as you are being warned of deleting/binning a protected folder, you can opt to use "unlink X11" command instead to remove the symlink. this worked for me and hope it helps.

to understand or test the issue you can try the following which in the case of trying to disable system integrity results in an error

$ csrutil status
System Integrity Protection status: enabled.
$ csrutil disable
csrutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.