Resolved Newb: Please help me delete stubborn system files

[bogdanw]

Before writing, I have tried in Recovery of a macOS 15.2 virtual machine and it worked.


You can also see my clumsy attempts to use a wildcard for the two prefpane folders installed by WacomTablet_6.4.8-3a

 

[Grumpus]

Before writing, I have tried in Recovery of a macOS 15.2 virtual machine and it worked

I wonder if that's because it's a VM. On my M3 MBP running 14.7.2, /Volumes/Macintosh HD/Library is empty until I manually decrypt/unlock and mount disk3s5, which is the volume containing Macintosh HD - Data.

-bash-3.2# diskutil list
-bash-3.2# diskutil apfs unlockVolume disk3s5
[Passphrase entered here]
-bash-3.2# diskutil mount disk3s5

I'd be interested in knowing if you see the same thing on bare metal.

 

[bogdanw]

I'd be interested in knowing if you see the same thing on bare metal.

I can’t properly test that. I don’t have Sequoia installed, I have SIP disabled and I don’t use FileVault.
I tried from Recovery, MBA M1, Sonoma 14.7.2 (23H311) and I could write/delete without additional steps.


Regarding Wacom software uninstallation, the Install Wacom Tablet.pkg from WacomTablet_6.4.8-3a.dmg has a preinstall script that kills running Wacom processes before trying to remove obsolete files. Here it is:

#! /bin/bash

#    Remove old obsolete files
declare -a ObsoleteFiles=( "$HOME/Library/Group Containers/EG27766DY7.com.wacom.WacomTabletDriver/Library/Preferences/com.wacom.Wacom-Desktop-Center.plist"
                                    "/Applications/Wacom Tablet.localized/Wacom Desktop Center.app"
                                    "/Library/Application Support/Tablet/WacomTabletSpringboard"
                                    "/Library/LaunchDaemons/com.wacom.TabletHelper.plist"
                                    "/Library/PrivilegedHelperTools/com.wacom.TabletHelper.app"
                                    "/Library/LaunchAgents/com.wacom.DisplayMgr.plist"
                                    "/Library/Internet Plug-Ins/WacomTabletPlugin.plugin"
                                    "/Library/PreferencePanes/Tablet.prefPane"
                                    "/Library/PreferencePanes/Wacom Tablet.prefPane"
                                    "/Library/PreferencePanes/Pen Tablet.prefPane"
                                    "/Library/StartupItems/Tablet/Tabet"
                                    "/Library/StartupItems/Tablet/TabetDriver.app"
                                    "/Library/StartupItems/Tablet/TabetDriverRelauncher"
                                    "/Library/StartupItems/Tablet/StartupParameters.plist"
                                    "/Library/StartupItems/Tablet/"
                                    "/Applications/Tablet.localized/RemoveTablet.app"
                                    "/Applications/Tablet.localized/.localized"
                                    "/Applications/Tablet.localized/.DS_Store"
                                    "/Library/Receipts/InstallConsumerTablet.pkg"
                                    "/Library/Receipts/InstallProTablet.pkg"
                                    "/Library/Receipts/InstallSemiproTablet.pkg"
                                    "/Library/Extensions/TabletDriver.kext"
                                    "/Library/Extensions/WacomTablet.kext"
                                    "/System/Library/Extensions/TabletDriver.kext"
                                    "/System/Library/Extensions/WacomTablet.kext"
                                    "/Library/Internet Plug-Ins/WacomSafari.plugin"
                                    "/Library/Application Support/Tablet/WacomTabletDriver.app"
                                    "/Library/Application Support/Tablet/WacomTouchDriver.app"
                                    "/Library/Application Support/Tablet/TabletDriver.app")

#    These are the directries we can wholesale delete
declare -a CurrentDirectoryList=("/Applications/WacomTablet"
                                            "/Library/Application Support/Tablet")

declare -a AppSupportList=("/Library/Application Support/Tablet/WacomTabletDriver.app")

declare -a ExtensionsList=("/Library/Extensions/FTDIKext.kext"
                                    "/Library/Extensions/SiLabsUSBDriver64.kext"
                                    "/Library/Extensions/Wacom Tablet.kext")

declare -a KextList=("com.Wacom.iokit.TabletDriver"
                            "com.wacom.kext.wacomtablet"
                            "com.apple.driver.AppleUSBFTDI"
                            "com.wacom.kext.ftdi"
                            "com.silabs.driver.CP210xVCPDriver64"
                            "com.wacom.WacomTabletHIDDevice")

declare -a AgentList=("/Library/LaunchAgents/com.wacom.DataStoreMgr.plist"
                             "/Library/LaunchAgents/com.wacom.wacomtablet.plist"
                             "/Library/LaunchAgents/com.wacom.DisplayMgr.plist"
                             "/Library/LaunchAgents/com.wacom.IOManager.plist")

declare -a DaemonList=("/Library/LaunchDaemons/com.wacom.DisplayHelper.plist"
                              "/Library/LaunchDaemons/com.wacom.UpdateHelper.plist"
                              "/Library/LaunchDaemons/com.wacom.TabletHelper.plist")

declare -a ProgramList=("WacomTabletDriver"
                                "WacomTouchDriver"
                                "TabletDriver"
                                "Wacom Tablet Utility"
                                "Wacom Desktop Center"
                                "Wacom Center"
                                "Wacom Experience Program"
                                "UpgradeHelper"
                                "System Preferences")

#
#    First kill all the running Applications
#
for aProgram in "${ProgramList[@]}"
do
    PID=`ps -ax | grep "$aProgram" | awk '{print $1}'`
    if [ -n "$PID" ]
    then
        for aProcess in $(echo $PID | tr ";" "\n")
        do
            echo "Killing $aProgram $aProcess"
            kill -9 "$aProcess"
        done
    fi
done
sleep 1

#
#    Next shutdown the Agents
#
for anAgent in "${AgentList[@]}"
do
    echo "shutting down $anAgent"
    sudo -u $USER launchctl unload "$anAgent"
done
sleep 1

#
#    Next shutdown the Daemons
#
for aDaemon in "${DaemonList[@]}"
do
    echo "shutting down $aDaemon"
    launchctl unload "$aDaemon"
done
sleep 1

#
#    Now unload the Kexts
#
for aKext in "${KextList[@]}"
do
    echo unloading "$aKext"
    /sbin/kextunload -m "$aKext"
done

#
# Copy driver plist for analytics
#

if [ -e "/Library/Application Support/Tablet/" ]
then
    /usr/sbin/chown root:admin "/Library/Application Support/Tablet"
    /bin/chmod ug+w "/Library/Application Support/Tablet"
    /bin/cp "/Applications/Wacom Tablet.localized/.Tablet/WacomTabletDriver.app/Contents/Info.plist" "/Library/Application Support/Tablet/com.wacom.installdata"
    /bin/chmod a+wx "/Library/Application Support/Tablet/com.wacom.installdata"
    if [ -e "/Library/Application Support/Tablet/License.rtf" ]
    then
        /bin/rm "/Library/Application Support/Tablet/License.rtf"
    fi
else
    /bin/mkdir "/Library/Application Support/Tablet"
    /usr/sbin/chown root:admin "/Library/Application Support/Tablet"
    /bin/chmod ug+w "/Library/Application Support/Tablet"
    /usr/bin/touch "/Library/Application Support/Tablet/com.wacom.installdata"
    /bin/chmod ug+w "/Library/Application Support/Tablet/com.wacom.installdata"
fi

#
#    Clean up
#
for obsFile in "${ObsoleteFiles[@]}"
do
    echo deleting "$obsFile"
    if [ -e "$obsFile" ]
    then
        echo deleting "$obsFile"
        /bin/rm -r "$obsFile"
    fi
done

Extracted from the pkg with Suspicious Package https://www.mothersruin.com/software/SuspiciousPackage/

 

[Grumpus]

I can’t properly test that. I don’t have Sequoia installed, I have SIP disabled and I don’t use FileVault.

FileVault is the answer. When I turn it off and boot to Recovery, Macintosh HD - Data is mounted automatically.

 

[smartin80]

Your Honor, I want to recant my previous testimony....

The easiest and safest thing for you to do would be to boot to Recovery, open a Terminal, and use csrutil disableto turn off SIP. Then restart using the Apple menu, log on, open a Terminal and remove the unwanted files and directories. When done, you can boot back to Recovery, open a Terminal and use csrutil enableto turn SIP back on.

I'm changing my advice because after booting to Recovery you'll likely find that Macintosh HD - Data won't be mounted, and since that's where /Library actually lives you won't be able to delete anything from it. Mounting it isn't particularly difficult (details on request), but since hanging out in a Recovery mode Terminal can be an invitation to disaster, KISS is the best approach.

I really appreciate your, and everyone else's, kind advice Wish I'd come here a few days ago, before I fried my brain...