Resolved System Integrity Protection migrated files

[KALLT]

Answer: The archived system files of a previous system are located in /Library/SystemMigration. You can delete the folder (saved me 800 MB), but it may not work if you had a previous beta installation of El Capitan. In this case you need to turn off System Integrity Protection temporarily or delete the folder remotely from Recovery or a previous OS X installation.

---

I know that upon installation, the system installer moves everything in protected locations (e.g. /System, /bin, /sbin/, /usr) that doesn’t belong there to another location. My question is: where?

I came across two suggestions:
/Library/PreviousSystems
/Library/SystemMigration

I only have the latter folder, so I don’t know for sure. I’m asking this, because I’m doing some housekeeping and would like to remove the stuff I don’t need anymore. Just curious where the files end up.

 

[Weaselboy]

I found this in the Ars review here.

When upgrading from previous versions of OS X to El Cap, any and all non-Apple files found to be residing in those directories will be picked up and moved to /Library/SystemMigration/History/Migration-(some UUID)/QuarantineRoot/—which will almost certainly render whatever application or piece of hardware that depended on those files nonfunctional.

(Correction: We originally listed /Library/PreviousSystems as the SIP third-party migration target, since that location was the one given in Apple's prerelease developer documentation for SIP, but this is incorrect. The correct location, complete with a randomly-assigned UUID, is now shown above.)

So it looks like /Library/SystemMigration is the only place they go. I have that folder and not PreviousSystems here on my El Capitan upgrade install also.

Are you thinking like me we would be safe to dump that entire folder? I have about 800MB of cruft in there.

 

[KALLT]

That clears it up, I read that part in their review before, hence the confusion.

I am not sure. My QuarantineRoot folder does have a /System, /usr and /private folder all with a few files. However, these files all don’t look familiar and I’m fairly positive that I didn’t install or change them myself. But if Ars Technica is correct, they will be inaccessible to any program anyway, so it shouldn’t really matter, I suppose, if the folder is gone. Strangely though, removing these files requires root access.

//Edit

My folder is 800 MB in size as well, wow. Do you have these dyld_shared_cache files?

 

[Weaselboy]

I poked around in mine and the only thing I recognized that I installed was a libdvdcss library from Handbrake. Everything else looked like old stuff from the OS.

I just deleted mine and rebooted with no ill effects. I have it cloned off if I need anything back. I just deleted the folder contents and left the SystemMigration folder and that only prompted for an admin password and not root for me.

//Edit

My folder is 800 MB in size as well, wow. Do you have these dyld_shared_cache files?

Yep.

 

[KALLT]

I was able to move the entire folder to Trash, but there I couldn’t delete it, because ‘in use’. Reboot didn’t solve it. Hmm..

 

[pastrychef]

I just deleted mine and rebooted with no ill effects.

I did the same. Thanks for the tip!

 

[mannyo1221]

Disable System integrity protection whilst booted in recovery mode,
Terminal > csrutil disable
then restart normally and empty the trash.

Once done restart into Recovery again and enable system integrity protection.
Terminal > csrutil enable
Restart and carry on.

 

[pastrychef]

Disable System integrity protection whilst booted in recovery mode,
Terminal > csrutil disable
then restart normally and empty the trash.

Once done restart into Recovery again and enable system integrity protection.
Terminal > csrutil enable
Restart and carry on.

Huh? What does that have to do with this thread?

 

[KALLT]

Huh? What does that have to do with this thread?

Have you been able to empty your Trash when you moved the folder there?

 

[pastrychef]

Have you been able to empty your Trash when you moved the folder there?

Didn't empty yet.

Edit: Just emptied. No need to turn off SIP.

 

[KALLT]

Didn't empty yet.

Edit: Just emptied. No need to turn off SIP.

It’s not working for me, even after a reboot. Still says all are in use.

 

[pastrychef]

I didn't even reboot. I just double checked that nothing else was in trash that I needed and then pressed empty.

 

[pastrychef]

Based on the following article:

http://arstechnica.com/apple/2015/09/os-x-10-11-el-capitan-the-ars-technica-review/8/

Only these directories are restricted:

Since the SystemMigration folder is in /Library, SIP should not give you any problems deleting it.

 

[KALLT]

Based on the following article:

http://arstechnica.com/apple/2015/09/os-x-10-11-el-capitan-the-ars-technica-review/8/

Only these directories are restricted:

View attachment 589510

Since the SystemMigration folder is in /Library, SIP should not give you any problems deleting it.

SIP is not the problem. The problem is that these files are still in use. This worries me a bit more than not having write access.

 

[Wheelie4]

If you are unable to empty the trash with that folder in it and you really want to delete it try "Secure Empty Trash" and see if that works.

 

[chrfr]

SIP is not the problem. The problem is that these files are still in use. This worries me a bit more than not having write access.

Try these:
-boot into safe boot by holding shift and see if the files delete that way.
-try to delete in Terminal by typing

sudo rm -rf

and then drag the folder from the trash to the Terminal window to have the path transferred there. Then press return and enter your password when prompted.

 

[KALLT]

If you are unable to empty the trash with that folder in it and you really want to delete it try "Secure Empty Trash" and see if that works.

That option is gone in El Capitan.

Try these:
-boot into safe boot by holding shift and see if the files delete that way.
-try to delete in Terminal by typing

sudo rm -rf

and then drag the folder from the trash to the Terminal window to have the path transferred there. Then press return and enter your password when prompted.

Thanks for the suggestion. Is there any way to find out which process is still accessing these files?

 

[chrfr]

Is there any way to find out which process is still accessing these files?

use

sudo lsof |grep yoursearchtermhere

On my computer there's a root owned process called UserEventAgent which is using those SystemMigration files.
They seem like they should be there, so perhaps deleting them is ill-advised.

 

[KALLT]

use

sudo lsof |grep yoursearchtermhere

On my computer there's a root owned process called UserEventAgent which is using those SystemMigration files.
They seem like they should be there, so perhaps deleting them is ill-advised.

I tried that yesterday, but it returns nothing. Tried SystemMigration as well as some other files and folders within it.

 

[KALLT]

Attempting to delete a file from the Terminal will return this:

$ cd ~/.Trash/SystemMigration/History/Migration-F1985D55-D0A0-422E-92B6-36A6E48E6CAE/QuarantineRoot/System/Library/LaunchAgents
$ sudo rm com.apple.AirPortBaseStationAgent.plist
override rw-r--r--  root/wheel restricted for com.apple.AirPortBaseStationAgent.plist? y
rm: com.apple.AirPortBaseStationAgent.plist: Operation not permitted

I haven’t seen this before.

 

[chrfr]

Attempting to delete a file from the Terminal will return this:

$ cd ~/.Trash/SystemMigration/History/Migration-F1985D55-D0A0-422E-92B6-36A6E48E6CAE/QuarantineRoot/System/Library/LaunchAgents
$ sudo rm com.apple.AirPortBaseStationAgent.plist
override rw-r--r--  root/wheel restricted for com.apple.AirPortBaseStationAgent.plist? y
rm: com.apple.AirPortBaseStationAgent.plist: Operation not permitted

I haven’t seen this before.

Those particular files are indeed SIP protected. You can see this by using

ls -lO

(that's a capital letter O.)
SIP protected files show a "restricted" in the output of ls.

 

[KALLT]

Those particular files are indeed SIP protected. You can see this by using

ls -lO

(that's a capital letter O.)
SIP protected files show a "restricted" in the output of ls.

Interesting, it seems that every end folder has at least one restricted file. Even the ‘empty’ CoreServices folder has a hidden file with a restricted flag. Maybe SIP is the problem after all.

 

[adnbek]

Deleting just the Quarantine folder works fine. No need to delete the "SystemMigration" root folder.

Had no problem emptying trash after. YMMV

 

[KALLT]

Deleting just the Quarantine folder works fine.

Except when it doesn’t. When I attempt to do that, all the sub folders of QuarantineRoot are marked as ‘in use’. When I attempt to do it with sudo rm -r then I get the response above.

I think this might be something related to the beta. I had to install OS X with the installer again when the GM arrived, so naturally it would have moved all unnecessary components out of the way. That would explain why these files are flagged as restricted.

 

[Weaselboy]

I think this might be something related to the beta. I had to install OS X with the installer again when the GM arrived, so naturally it would have moved all unnecessary components out of the way. That would explain why these files are flagged as restricted.

Just as a data point, I was never on any of the betas.... so you may be onto something there. It does not seem like the rest of us are not having this issue.