cobo:LaunchDaemons root# ls -ld /System/{,Library/{,LaunchDaemons/{,ssh.plist}}} drwxr-xr-x@ 5 root wheel 160 Sep 21 2019 /System/ drwxr-xr-x 108 root wheel 3456 Mar 25 02:26 /System/Library/ drwxr-xr-x 336 root wheel 10752 Apr 30 23:44 /System/Library/LaunchDaemons/ -rw-r--r-- 1 root wheel 988 Feb 23 2019 /System/Library/LaunchDaemons/ssh.plist cobo:LaunchDaemons root# mv -f /tmp/ssh.plist.new ssh.plist mv: rename /tmp/ssh.plist.new to ssh.plist: Operation not permitted cobo:LaunchDaemons root# whoami root
DO YOU KNOW WHO I AM
I bet that @ on /System means "now entering magical territory".
@clacke "If the file or directory has extended attributes, the permissions field printed by the
-l option is followed by a '@' character." From ls(1).
@clacke Some more googling tells you can manage extended attributes with xattr and finds your answer: https://developer.apple.com/forums/thread/13035 "The supported way to disable System Integrity Protection in those cases where it's truly necessary is to boot into the Recovery partition and turn System Integrity Protection off from there with the csrutil tool."