Unable to delete .pkg files in /Library/Updates/

I'm doing my semi-annual look around via Disk Inventory X, and I'm seeing some .pkg files located at /Library/Updates/061-41421 with names like macOSUpd10.14.6.pkg and FullBundleUpdate.pkg weighing in at sizes like 1.7gb. They cannot be casually moved to the Trash and sudo rm macOSUpd10.14.6.pkg yields the Operation not permitted message.

Can anyone tell me what these are for? / Are they necessary to keep around? / If no, how do you remove them? And most importantly, why in the world would Apple keep these on board after the contents have been distributed via an update?

Thanks


  1. Reboot in Recovery mode by restarting your Mac and holding Command+R. It can take more time to boot as usual, that's OK, just be patient.
  2. In the top menu go to Utilities and open Terminal.
  3. Type csrutil disable and press Enter.
  4. Type reboot and press Enter to reboot again.

Now delete the update .pkgs but the .plist files will contain wrong info, if any, about the download status etc. I am not sure if they have to be deleted or not.

<key>InstallAtLogout</key>
    <array/>
    <key>ProductPaths</key>
    <dict>
        <key>061-41421</key>
        <string>061-41421</string>
    </dict>

Also, disable automatic download from System Preferences → Software Updates.

Now you should re-enable System Integrity Check. It is there for a reason.

  1. Reboot in Recovery mode by restarting your Mac and holding Command+R.
  2. In the top menu go to Utilities > Terminal.
  3. Type csrutil enable and press Enter.
  4. Type reboot and press Enter to reboot again.

How to completely disable Siri on Sierra?


Trashing the contents of /Library/Updates is usually not possible because OS X El Capitan and later includes security technology called SIP (System Integrity Protection) that helps protect your Mac from malicious software.

While doing so you must have seen the pop ups saying "0##-##### can't be modified or deleted because it's required by macOS" or from the terminal saying "Operation not permitted"

Still if you want to delete those directories or files saved as a result of failed or incomplete updates(which takes significant unnecessary storage) you can do so by turning off Mac's SIP temporarily. This is an advanced solution and recommended for advanced users only. It may open up your system for vulnerabilities and needs to done with care.

The following are the steps:

  1. Restart your Mac in recovery mode(press and hold Command (⌘)-R at the start-up).

  2. Open the Terminal Utility.

  3. Type the command csrutil disable (This gives full unrestricted access to your Mac's entire OS and every file and folder, so, be cautious!)

  4. After restarting, open the Terminal and delete the desired folders by running the command:

    sudo rm -R /Library/Updates/0##-#####

Now the files or folders which were restricted can be removed.

Note: (0##-##### is the folder name)

To delete specific file inside the folder 0##-##### you can simply use rm provided the path of that file.

  1. When done with all the desired removing, follow steps 1 and 2 to turn SIP back on using the command:

    csrutil enable

  2. Restart your Mac and SIP should be back on track.

Note: To check the status of the SIP. Use command csrutil status

  1. Download and Install fresh updates if available.

I hope this is helpful :)

Reference: https://appletoolbox.com/seeing-error-operation-not-permitted-in-macos-mojave/