Immutable flags

Immutable flags, also known as immutable bits, are file system attributes that, when enabled, prohibit changes to files or folders (objects), i.e. lock them. Enabled, immutable flags supersede permissions: you cannot modify an object whose immutable flags have been enabled despite having Read & Write permissions on that object.

File system flags, including the immutable flags, are enabled or disabled with the chflags (change flags) Terminal command. The various file system flags are enumerated in the man page for chflags. This FAQ focuses on the user immutable (uchg) and system immutable (schg) flags.

The user immutable flag locks an object at the user level. For example, the user immutable flag of an object is enabled by locking the object, i.e. selecting Locked in the General pane of its Info window; deselecting Locked disables the user immutable flag. This is a weak lock, intended to prevent casual or inadvertent modifications or deletions of user objects, such as files or folders in your Home folder.

The system immutable flag is a strong lock, unbreakable at the Standard user level. The system immutable flag can be enabled or disabled by the superuser (root). In Mac® OS X 10.4 and earlier, the system immutable flag can only be disabled when the computer is started up in single-user mode. In Mac OS X 10.5 and later, the system immutable flag can also be enabled or disabled by:

  • Software operating with root privileges.
  • An Admin user in Terminal. [1]

This FAQ applies to Mac OS X 10.7 and earlier and addresses the following topics:

Problems due to immutable flags

On the desktop or in Finder windows, an object will display a lock badge in the lower-left corner of its icon if its user or system immutable flags are enabled. In Icon view, the lock badge will only appear if Show icon preview is deselected in View Options.

Problems with immutable flags, especially the system immutable flag, should be rare. They may indicate directory corruption on the volume containing the affected objects. Novice Admin users attempting to lock files with Terminal may inadvertently set the system immutable flag on a file, folder, or volume.

The types of problems attributable to immutable flags depends on the version of Mac OS X you are using and which immutable flag has been set.

Problems with user immutable flags

As noted earlier, the user immutable flag is enabled on an object by selecting Locked in the General pane of its Info window, as seen in the following screen shot:

You can disable the user immutable flag by opening the Info window of the object and deselecting Locked.

In any version of Mac OS X, a locked object cannot be modified.

In Mac OS X 10.4 and earlier, an object whose user immutable flag has been set — a locked object — cannot be moved, copied, modified, or placed in the Trash.

In Mac OS X 10.5 and earlier, if the Trash contains locked objects, emptying the Trash requires pressing and holding either the Option key or the Shift-Option keyboard shortcut while emptying the Trash.

In Mac OS X 10.5 and later, locked objects can be moved to the trash, but you must first confirm your intent to do so by clicking Continue in the following alert dialog:

In Mac OS X 10.6 and later, moving a locked object creates a copy of the object and simply emptying the Trash discards locked files you placed in the Trash.

Problems with system immutable flags

In any version of Mac OS X, you cannot modify, copy, move, unlock, or place in the Trash any object whose system immutable flag has been set. The one exception to this is Mac OS X 10.6, where moving such an object creates a copy whose user immutable flag is enabled, permitting the copy to be unlocked via its Info window.

If you attempt to unlock a locked object by deselecting Locked in the General pane of its Info window, but Locked immediately reverts to selected, then the system immutable flag has been set for that object.

In Mac OS X 10.6 and later, attempting to place in the Trash an object whose system immutable flag is enabled results in the confirmation prompt seen above, followed by a prompt to authenticate, after which it fails with the following alert dialog:

This alert dialog is somewhat misleading in the case where the user has the correct permissions on the object, but its system immutable flag is enabled: it is the system immutable flag — not permissions — causing the alert.

If a programming error enables the system immutable flag of an object in the Trash, the Trash cannot be emptied by any of the usual workarounds, such as pressing and holding the Option key or the Shift-Option keyboard shortcut while emptying the Trash.

In Mac OS X 10.6 and later, the following alert dialog appears while attempting to empty the Trash when it contains an object whose system immutable flag is enabled:

Clicking Remove All Items does not delete the objects whose system immutable flags are enabled.

Determining the flags set on an object

If you suspect an immutable flag to be causing a problem with a given object, determine which flags are set for that object as follows:

1. Open Terminal, located in the Macintosh HD > Applications > Utilities folder.
2. At the Terminal prompt, type the following ls (list) command
ls -lhdO /pathname
where /pathname is the path of the object in question. [2]
If you do not know the path of the object:
2.1. At the Terminal prompt, type
ls -lhdO
followed by a single space, but do not press Return yet.
2.2. Drag and drop the icon of the object from a Finder window into the Terminal window. The path of the object appears after the command typed in step 2.1.
3. Press Return.

The output will be in the following format:

file-mode-and-permissions nn owner group flags size Month Day hh:mm /pathname

Deconstructing this output:

file mode & permissions Example: -rw-r--r--

The first character in the output indicates the file mode, e.g. a file (-) or a directory (d).

The remaining characters specify the access modes or permissions assigned to that object. If this strings ends in an at sign (@), the object has extended attributes. If this string ends in a plus sign (+), the object has extended security information, such as an Access Control List (ACL).
nn The number of links to the object. Normally this is one (1) for files, greater than one for folders.
owner The short name of the user account that owns the object.
group The group name that owns the object.
flags File system flags set on the object; flags will be discussed shortly and are the focus of this analysis.
size Size of the object.
Month Day hh:mm The abbreviated month, abbreviated day of the week, and time (hours:minutes in local time) when the object was last modified.
/pathname The path of the object.

For example, if a user with the account short name johndoe executed the ls -lhdO command on the file Test.rtf on their Desktop, the output might show the following in the flags position:

• If no flags are enabled, a dash (-) appears in the flags position:
-rw-r--r-- 1 johndoe staff - 318B Sep 26 15:50 /Users/johndoe/Desktop/Test.rtf
• If the user immutable flag is enabled, uchg appears in the flags position:
-rw-r--r-- 1 johndoe staff uchg 318B Sep 26 15:50 /Users/johndoe/Desktop/Test.rtf
• If the system immutable flag is enabled, schg appears in the flags position:
-rw-r--r-- 1 johndoe staff schg 318B Sep 26 15:50 /Users/johndoe/Desktop/Test.rtf
• If both the user and system immutable flags are enabled, schg,uchg appears in the flags position:
-rw-r--r-- 1 johndoe staff schg,uchg 318B Sep 26 15:50 /Users/johndoe/Desktop/Test.rtf

Resolving common problems with immutable flags

1. If only the user immutable flag is enabled on the object, deselect Locked in the General pane of its Info window.

Note: If Locked immediately reverts to selected, the system immutable flag is enabled.
2. If the system immutable flag is enabled on an object:
2.1. Use Disk Utility to check the volume containing the affected objects for directory corruption:

Readers of our Troubleshooting Mac OS X e-books can consult the "Verify Disk Process" or "Repair Disk Process" chapters for details. Otherwise, see our "Resolving Disk, Permissions, and Cache Corruption" FAQ if the affected objects are on the startup disk.

Repairing the volume containing the affected objects may solve the problem.
2.2. If the problem remains, do one of the following based on your version of Mac OS X:
Mac OS X 10.5 and earlier

Print and follow the instructions in the AppleCare Knowledge Base document "Unable to move, unlock, modify, or copy an item in Mac OS X."
Mac OS X 10.5 and later

An Admin user can disable the immutable flags in Terminal: see "Disabling system immutable flags in Terminal" below.

Disabling system immutable flags in Terminal

In Mac OS X 10.5 and later, use the following procedure to disable the system immutable flag on all objects in a user account. This procedures employs a variant of the command in the AppleCare Knowledge Base document "Unable to move, unlock, modify, or copy an item in Mac OS X."

1. Log in to the Admin account.
2. Open Terminal, located in the Macintosh HD > Applications > Utilities folder.
3. At the Terminal prompt, type the following command:
sudo find "/Users/shortname/" -flags schg -exec chflags noschg {} \;
where shortname is the short name of the affected account.

Note: To disable system immutable flags on the entire startup disk, type the command:

sudo find / -flags schg -exec chflags noschg {} \;
4. Press Return.
5. Type your Admin password when prompted, then press Return.
6. End the Terminal session: press the Control-D keyboard shortcut, then Quit (Command-Q) Terminal.

Notes:

[1] Whether or not an application with root privileges or a Admin user can change system immutable flags depends on the setting of the security level of the operating system. You can determine the security level by typing the command
sysctl kern.securelevel
at a Terminal prompt and pressing Return. The output is an integer between -1 and 2.
In Mac OS X 10.4 and earlier, the default security level was 1: system immutable flags can only be disabled when the system is started up in single user mode.
In Mac OS X 10.5 and later, the default security level was lowered to 0, permitting Admin users or applications operating with root privileges to change system immutable flags.
For more information about kernel security levels, see the man page for init(8).
[2] The ls (list) command shown employs the following flags:
l: Return output in long format, i.e. all of the data seen in the examples.
h: Return output in human-readable form, e.g. display the size of large files with unit suffixes, e.g. K for kilobytes, G for gigabytes, etc. vs. in bytes, reducing the width of the output.
d: List directories as files and do not list the contents of the directory. Substitute a for d in the command to see the full contents of a directory specified in /pathname, including hidden files.
O: (Upper case "o") Include flags in the output.
Did you find this FAQ helpful? You will find a wealth of additional advice for preventing or resolving Mac OS X problems in Dr. Smoke's book, Troubleshooting Mac® OS X.
Use of this site signifies your agreement to the terms of use.