Can't remove file from trash

I'm having trouble emptying the trash on Catalina. FileVault is enabled. Trying to empty from Finder warns X11R6 can't be modified or deleted because it's required by macOS. It's a link to /opt/X11 which is a regular directory. OK let's try in Terminal:

fifteen:.Trash elliott$ pwd; ls -al
/Users/elliott/.Trash
total 272
drwx------    4 elliott  staff     128 Nov 11 21:44 .
drwxr-xr-x@ 125 elliott  staff    4000 Nov 10 22:23 ..
-rw-r--r--@   1 elliott  staff  135172 Nov 11 21:44 .DS_Store
drwxr-xr-x    3 root     wheel      96 Nov 11 21:42 Security

fifteen:.Trash elliott$ sudo rm -rf Security/
Password:
rm: Security//usr/X11R6: Operation not permitted
rm: Security//usr: Directory not empty
rm: Security/: Directory not empty

fifteen:.Trash elliott$ ls -l Security/usr/
total 0
lrwxr-xr-x  1 root  wheel  8 May 19 11:37 X11R6 -> /opt/X11

I have already given Terminal full disk access in System Preferences.

Checking the rm command with dtruss I see it fails here:

unlink(".Trash/Security/usr/X11R6\0", 0x0, 0x0)      = -1 Err#1
write_nocancel(0x2, "rm: \0", 0x4)       = 4 0
getrlimit(0x1008, 0x7FFEED8FA680, 0x0)       = 0 0
write_nocancel(0x2, ".Trash/Security/usr/X11R6\0", 0x19)         = 25 0
write_nocancel(0x2, ": \0", 0x2)         = 2 0
write_nocancel(0x2, "Operation not permitted\n\0", 0x18)         = 24 0

I also verified that this file is on the read-write Data partition:

sh-3.2# ls -l /System/Volumes/Data/Users/elliott/.Trash/Security/usr/
total 0
lrwxr-xr-x  1 root  wheel  8 May 19 11:37 X11R6 -> /opt/X11

Solution 1:

This is a known issue that has impacted a number of users following an upgrade to Catalina¹.

The best way to resolve this is to disable System Integrity Protection (SIP), delete the files/empty the trash, then re-enable SIP.

Full instructions provided below for the benefit of users unfamiliar with the process of disabling/enabling SIP:

1. Startup (or restart) your Mac
2. Immediately hold down the commandR keys to boot into recovery
3. Click the Utilities menu and select Terminal
4. Type csrutil disable and press return
5. Close the Terminal app
6. Restart your Mac
7. Delete the files and/or empty the trash
8. Restart your Mac
9. Immediately hold down the commandR keys to boot into recovery
10. Click the Utilities menu and select Terminal
11. Type csrutil enable and press return
12. Close the Terminal app
13. Restart your Mac

^{1. In most cases, the affected users had XQuartz installed prior to the Catalina upgrade and during the upgrade process XQuartz isn't uninstalled properly.}

Solution 2:

As mentioned, you can fix this in Recovery mode itself. However you must first mount your Macintosh disk (at least on Catalina) to get access to the Trash while in Recovery mode. Here are the steps that worked for me on Mac OS 10.15.4:

1. Find out the path to your Trash by running this command in Terminal

   echo /Users/$(whoami)/.Trash/?*
   

   Should be something like /Users/bob/.Trash/?*. Note it down on paper or your phone.

2. Restart your Mac

3. Immediately hold down commandR to boot into Recovery mode
4. In Recovery mode, open Disk Utilities
5. Mount your "Macintosh HD" volume (the main one)
6. Quit Disk Utility
7. Click the Utilities menu and select Terminal

8. The "Macintosh HD" will be available under /Volumes/Macintosh\ HD. Prefix the path you noted down with that. The full path to your trash will be something like this:

   /Volumes/Macintosh\ HD/Users/bob/.Trash/?*
   

   Remember to replace bob there with the right user name.

   Verify by running this in Terminal:

   ls /Volumes/Macintosh\ HD/Users/bob/.Trash/?*
   

   and check that it contains those files you want to delete.

9. Delete the files:

   rm -rf /Volumes/Macintosh\ HD/Users/bob/.Trash/?*
   

10. Quit Terminal
11. Restart your Mac

Note: I actually ran csrutil disable before step 8 and then csrutil enable after step 9, to temporarily disable the System Integrity Protection. I don't know if that was actually required or not. It seems it should not be required while in Recovery mode, but I haven't tested it. Let us know in the comments below.

Solution 3:

You can also just boot to recovery and remove the folder / files from the Terminal utility while booted to the recovery image. System Integrity Protection doesn't protect your normal system from modifications while booted to another OS.

If you want to get the full path to your user trash folder before you reboot, this command will get you the short name so you can copy this / print this out and have a "cheat sheet" of what to type when you're in recovery:

echo rm /Users/$(whoami)/.Trash/?*

The echo command doesn't delete, when you type the rm and press enter, that will try to delete the files and won't ask for permission or have an undo step, so be sure you have a backup if you think you won't get the path perfect. This will delete everything you put in the trash from your home folder.