Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Edit system files and folders read/write access Sequoia

F

Fred4

macrumors member
Original poster
Feb 21, 2020
40
6
Sequoia has become very difficult to work with.

There are a few really complicated methods I haven't tried yet, but I thought I would ask if anyone knows the easiest way to get write access to files Apple has locked beyond root access.

I've tried slaving the drive, booting to recovery and terminal, and all of the easy things I can think of.

I have not tried to install a Linux OS, see if there's a way to read/write access APFS, and go that route yet.

I want to be able to edit a few system files, and so far, it's not an easy thing.

I want to replace or edit the contents of an Apple app, like /Applications/Music.app

I want to edit a plist file in the protected system, like /Library/Keyboard Layouts/Keyboard-en.plist

Also, prevent macOS from always deleting the Network Utility app. They really don't like us having a working one. I have to unzip the working one all the time. No matter where it is, how it's named, they seem to have it out for this app.

...just a few examples, but so far, no luck so far.

This was easy before Sequoia. It's nearly ROM no

Some of the protected folders won't even list in the terminal, unless I look from a much older macOS. They locked us from seeing them, even from another Mac, and slaved drive.

My next thing might be to try slaving the drive to Catalina, but the file structure is a bit of a mess, and hard to find where they check to replace files that have been modified. I would have to replace the master file too. Perhaps just edit the master, and let the OS replace the files.

Any thoughts as to the easiest or sure way to accomplish this? Has anyone had success?
Is there a way to remove a file from their protection watch list?

Apple should have done better with the keyboards layout. I did try putting one in the user's Library folder, but the system ignores it.

* Also, SIP is off, and this is beyond anything they did in previous OS versions where doing this was easy.
 
It should work with the root user at least when SIP is disabled. I deleted some folders in /System/Library that doesn't even show delete in my standard admin account.
 
Not sure what you're intentions are in editing/changing macOS system files and applications but you should familiarize yourself with the boot volume group and the Signed System Volume.
eclecticlight.co

Boot volume layout and structure in macOS Sequoia

How the immutable system of the SSV, the firmlinked Data volume, and cryptexes ‘grafted’ into the directory tree combine to form the boot volume group of Intel and Apple silicon Macs ru…
eclecticlight.co eclecticlight.co
 
  • Like
Reactions: adrianlondon, gilby101 and kitKAC
Bigwaff said:
Not sure what you're intentions are in editing/changing macOS system files and applications but you should familiarize yourself with the boot volume group and the Signed System Volume.
eclecticlight.co

Boot volume layout and structure in macOS Sequoia

How the immutable system of the SSV, the firmlinked Data volume, and cryptexes ‘grafted’ into the directory tree combine to form the boot volume group of Intel and Apple silicon Macs ru…
eclecticlight.co eclecticlight.co
Click to expand...
Thanks, this is explaining what I assumed, that there's a master copy, and another volume.
I had booted to Catalina terminal, and looked at the Sequoia driver, and I can see that many of the files and folders simply don't exist.
They are there though when booting to terminal in Sequoia, so that it translating all of the missing files too. That's why Catalina terminal really shows what's physically there.

Now, I am wondering if it's even possible to get at the files. At least to replace a couple, and edit the one plist.
They are definitely being protected with SSV.

I want to replace the Music.app, with the one I fixed and removed AVX2, so it would stop crashing.

I would like to edit my keyboard.plist file. Hopefully Apple will allow us to use one in the user folder some day.
I used to edit mine before Sequoia.

I would like to replace their disabled Network Utility with the working one.

If these things could be done in the SSC master, then I think it would fix my issues.

The first two are the most important, but the last would just be nice.
I can keep unzipping network utility every time Apple deletes it. They really go after it, no matter how it's named, or where its placed.

Let me know if you think any of this is possible.
For now, I have a duplicate Music.app that I named Music NOAVX.app, but since the default can't be deleted, mine has to be up and running, otherwise, calling up the app would just launch the OS default.

I wish knew more how OCLP worked, but they have no support, or any way of posting a message, or contacting them. Can't even inform them of bugs, and I've found more than a few. A couple of big ones.

OCLP has a Music.app file in it, and the bundle is not the full app, just a few little files, so I am wondering if I can place my changed files in it.
I may have to setup a test system and try it.
To fix the Music.app, the only thing that needs to be changed are the 3 plugins.
Completely stops the crashing, and no loss of functionality.

Thanks
 
Adora said:
It should work with the root user at least when SIP is disabled. I deleted some folders in /System/Library that doesn't even show delete in my standard admin account.
Click to expand...
thanks, but no. some of the files don't actually exist. they are in a protected volume, as I suspected. This only happened in Sequoia. I was able to make modifications before Sequoia.
It's SSV. see the other reply I got. It explains a lot.
 
joevt said:
Maybe research how OCLP does it?
Click to expand...
It doesn't modify the read-only SSV. Rather it injects stuff into the boot process (and only with older Intel).

Fred4 said:
I had booted to Catalina terminal, and looked at the Sequoia driver, and I can see that many of the files and folders simply don't exist.
Click to expand...
You are lucky you didn't make your system unbootable. It is liable to do things the Catalina way and scribble over important Sequoia system data. In general, using an older macOS which doesn't fully understand latest APFS is asking for trouble.

Fred4 said:
Some of the protected folders won't even list in the terminal, unless I look from a much older macOS.
Click to expand...
You haven't looked in the right places. Delve into /System.
 
Last edited:
gilby101 said:
It doesn't modify the read-only SSV. Rather it injects stuff into the boot process (and only with older Intel).


You are lucky you didn't make your system unbootable. It is liable to do things the Catalina way and scribble over important Sequoia system data. In general, using an older macOS which doesn't fully understand latest APFS is asking for trouble.


You haven't looked in the right places. Delve into /System.
Click to expand...

I booted from a Catalina USB installer, and went to terminal. Then I can see the actual files. Doing this from Sequoia terminal has different results. It accounts for the hidden and relocated files/folders.
So, I doubt this would corrupt anything, just listing files, but if it does, I'm doing it on a test Macbook, not my main Mac Pro

There is no /System, at least not like you would think.
That's what I'm saying, if you boot into Sequoia, even recovery terminal, the trickery with the hidden volumes happens.
This is why I used Catalina, to see the real structure.

Looking at the /Applications folder, I can see that Music.app doesn't even exist, but booting into Sequoia, it's there, but even as root, and SIP disabled, it cannot be modified. Not renamed, touched, deleted, replaced, NOTHING!

And, there's not much in /System, only a Library folder, and no apps.

I did list the entire drive looking for Music.app, but it't not there.

The closest thing I found was a Music.app in OCLP, but it was not the complete bundle.
 
Fred4 said:
I wish knew more how OCLP worked, but they have no support, or any way of posting a message, or contacting them. Can't even inform them of bugs, and I've found more than a few. A couple of big ones.
Click to expand...
It’s all here on the site, specifically

Including how to interact with devs and report bugs

Also, for learning how it works, you can’t ask for more than the code itself
github.com

GitHub - dortania/OpenCore-Legacy-Patcher: Experience macOS just like before

Experience macOS just like before. Contribute to dortania/OpenCore-Legacy-Patcher development by creating an account on GitHub.
github.com github.com
 
Fred4 said:
Looking at the /Applications folder, I can see that Music.app doesn't even exist, but booting into Sequoia, it's there, but even as root, and SIP disabled, it cannot be modified. Not renamed, touched, deleted, replaced, NOTHING!

And, there's not much in /System, only a Library folder, and no apps.
Click to expand...
All depends how you look. Music.app (and other apps in macOS) are in /System/Applications. View this in Finder or in Terminal ls -la /System/Applications. Apps not part of core macOS are in ls -la /Applications. The contents of /System/Applications and /Applications are combined (using "firmlinks") and shown by Finder as /Applications. "Trickery" if you like, but the structure is clear if you look carefully and understand what is going on - read and understand the link given by @Bigwaff along with other blog posts on Eclectic Light.

And, as you have discovered, /System/Applications is immutable This is by design and to protect the integrity of the operating system.

If you don't want to use Music.app, you are free to download and run alternatives. If you want to run an old version of Music.app then install an old version of macOS - though I really don't recommend this.
 
I don’t advise anyone to do this, but I tried in a 15.5 virtual machine and it's still possible to delete apps in /System/Applications/, as explained in the link above
apps.jpg


For Apple Silicon, the bless command is
Code: 
bless --mount "/Volumes/Macintosh HD/System/Library/CoreServices" --create-snapshot
 
gilby101 said:
All depends how you look. Music.app (and other apps in macOS) are in /System/Applications. View this in Finder or in Terminal ls -la /System/Applications. Apps not part of core macOS are in ls -la /Applications. The contents of /System/Applications and /Applications are combined (using "firmlinks") and shown by Finder as /Applications. "Trickery" if you like, but the structure is clear if you look carefully and understand what is going on - read and understand the link given by @Bigwaff along with other blog posts on Eclectic Light.

And, as you have discovered, /System/Applications is immutable This is by design and to protect the integrity of the operating system.

If you don't want to use Music.app, you are free to download and run alternatives. If you want to run an old version of Music.app then install an old version of macOS - though I really don't recommend this.
Click to expand...
If you boot to Catalina, you can see that those files do not physically exist.
Yes, I know they are using trickery, as you say, and that's why I am trying to find the actual real physical files.
If you boot to the terminal in Sequoia, you will see them, as above, because it's loading them virtually.
They are locked, and even root cannot modify them.
Booting to another OS that can read the actual drive, like Catalina, you can see the real files.
I am now trying to find where they really live, so I can modify them.

The music app is an example of one that I need to modify, and not because I don't like it, but because I need to fix it.
I want to use it, and I am using a modified duplicate of it fine, so now I want to replace the bad one, with the woking one.
In Sequoia, they started using AVX2 in the music app plugins. This causes it to crash constantly.
I have one I did, with the AVX removed, and it works.
OCLP either missed this, or there's nothing they can do about it. I don't know which, because their forum is locked, and you cannot post bug reports or contact them.

So, again, /System/Application doesn't really exist. If it's mounting a virtual disk, or some other method, that's what I am trying to find.
 
bogdanw said:
I don’t advise anyone to do this, but I tried in a 15.5 virtual machine and it's still possible to delete apps in /System/Applications/, as explained in the link above
View attachment 2511726


For Apple Silicon, the bless command is
Code: 
bless --mount "/Volumes/Macintosh HD/System/Library/CoreServices" --create-snapshot
Click to expand...
Music.app is protected and not there.
Yes, I can see my regular applications too, but the Apple protected applications are not there. They do not really exist in that path.
It's not in your screenshot.
 
Fred4 said:
Music.app is protected and not there.
Yes, I can see my regular applications too, but the Apple protected applications are not there. They do not really exist in that path.
It's not in your screenshot.
Click to expand...
It’s not there because I deleted it, along with Contacts, Books and others.
SystemApps.jpg
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back