Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Resolved System Integrity Protection migrated files

K

KALLT

macrumors 603
Original poster
Sep 23, 2008
5,380
3,415
Answer: The archived system files of a previous system are located in /Library/SystemMigration. You can delete the folder (saved me 800 MB), but it may not work if you had a previous beta installation of El Capitan. In this case you need to turn off System Integrity Protection temporarily or delete the folder remotely from Recovery or a previous OS X installation.

---

I know that upon installation, the system installer moves everything in protected locations (e.g. /System, /bin, /sbin/, /usr) that doesn’t belong there to another location. My question is: where?

I came across two suggestions:
/Library/PreviousSystems
/Library/SystemMigration

I only have the latter folder, so I don’t know for sure. I’m asking this, because I’m doing some housekeeping and would like to remove the stuff I don’t need anymore. Just curious where the files end up. :)
 
Last edited:
  • Like
Reactions: 997440
I found this in the Ars review here.

When upgrading from previous versions of OS X to El Cap, any and all non-Apple files found to be residing in those directories will be picked up and moved to /Library/SystemMigration/History/Migration-(some UUID)/QuarantineRoot/—which will almost certainly render whatever application or piece of hardware that depended on those files nonfunctional.

(Correction: We originally listed /Library/PreviousSystems as the SIP third-party migration target, since that location was the one given in Apple's prerelease developer documentation for SIP, but this is incorrect. The correct location, complete with a randomly-assigned UUID, is now shown above.)
Click to expand...

So it looks like /Library/SystemMigration is the only place they go. I have that folder and not PreviousSystems here on my El Capitan upgrade install also.

Are you thinking like me we would be safe to dump that entire folder? I have about 800MB of cruft in there.
 
That clears it up, I read that part in their review before, hence the confusion.

I am not sure. My QuarantineRoot folder does have a /System, /usr and /private folder all with a few files. However, these files all don’t look familiar and I’m fairly positive that I didn’t install or change them myself. But if Ars Technica is correct, they will be inaccessible to any program anyway, so it shouldn’t really matter, I suppose, if the folder is gone. Strangely though, removing these files requires root access.

//Edit

My folder is 800 MB in size as well, wow. Do you have these dyld_shared_cache files?
 
Last edited:
I poked around in mine and the only thing I recognized that I installed was a libdvdcss library from Handbrake. Everything else looked like old stuff from the OS.

I just deleted mine and rebooted with no ill effects. I have it cloned off if I need anything back. I just deleted the folder contents and left the SystemMigration folder and that only prompted for an admin password and not root for me.

//Edit

My folder is 800 MB in size as well, wow. Do you have these dyld_shared_cache files?
Click to expand...

Yep.
 
Last edited:
  • Like
Reactions: 997440
I was able to move the entire folder to Trash, but there I couldn’t delete it, because ‘in use’. Reboot didn’t solve it. Hmm..
 
Disable System integrity protection whilst booted in recovery mode,
Terminal > csrutil disable
then restart normally and empty the trash.

Once done restart into Recovery again and enable system integrity protection.
Terminal > csrutil enable
Restart and carry on.
 
mannyo1221 said:
Disable System integrity protection whilst booted in recovery mode,
Terminal > csrutil disable
then restart normally and empty the trash.

Once done restart into Recovery again and enable system integrity protection.
Terminal > csrutil enable
Restart and carry on.
Click to expand...

Huh? What does that have to do with this thread?
 
Based on the following article:

http://arstechnica.com/apple/2015/09/os-x-10-11-el-capitan-the-ars-technica-review/8/

Only these directories are restricted:

Screen Shot 2015-10-04 at 8.04.19 AM.png


Since the SystemMigration folder is in /Library, SIP should not give you any problems deleting it.
 
If you are unable to empty the trash with that folder in it and you really want to delete it try "Secure Empty Trash" and see if that works.
 
KALLT said:
SIP is not the problem. The problem is that these files are still in use. This worries me a bit more than not having write access.
Click to expand...
Try these:
-boot into safe boot by holding shift and see if the files delete that way.
-try to delete in Terminal by typing
Code: 
sudo rm -rf
and then drag the folder from the trash to the Terminal window to have the path transferred there. Then press return and enter your password when prompted.
 
  • Like
Reactions: 997440
Wheelie4 said:
If you are unable to empty the trash with that folder in it and you really want to delete it try "Secure Empty Trash" and see if that works.
Click to expand...

That option is gone in El Capitan.

chrfr said:
Try these:
-boot into safe boot by holding shift and see if the files delete that way.
-try to delete in Terminal by typing
Code: 
sudo rm -rf
and then drag the folder from the trash to the Terminal window to have the path transferred there. Then press return and enter your password when prompted.
Click to expand...

Thanks for the suggestion. Is there any way to find out which process is still accessing these files?
 
KALLT said:
Is there any way to find out which process is still accessing these files?
Click to expand...
use
Code: 
sudo lsof |grep yoursearchtermhere
On my computer there's a root owned process called UserEventAgent which is using those SystemMigration files.
They seem like they should be there, so perhaps deleting them is ill-advised.
 
  • Like
Reactions: 997440
chrfr said:
use
Code: 
sudo lsof |grep yoursearchtermhere
On my computer there's a root owned process called UserEventAgent which is using those SystemMigration files.
They seem like they should be there, so perhaps deleting them is ill-advised.
Click to expand...

I tried that yesterday, but it returns nothing. Tried SystemMigration as well as some other files and folders within it.
 
Attempting to delete a file from the Terminal will return this:
Code: 
$ cd ~/.Trash/SystemMigration/History/Migration-F1985D55-D0A0-422E-92B6-36A6E48E6CAE/QuarantineRoot/System/Library/LaunchAgents
$ sudo rm com.apple.AirPortBaseStationAgent.plist
override rw-r--r--  root/wheel restricted for com.apple.AirPortBaseStationAgent.plist? y
rm: com.apple.AirPortBaseStationAgent.plist: Operation not permitted
I haven’t seen this before.
 
  • Like
Reactions: 997440
KALLT said:
Attempting to delete a file from the Terminal will return this:

Code: 
$ cd ~/.Trash/SystemMigration/History/Migration-F1985D55-D0A0-422E-92B6-36A6E48E6CAE/QuarantineRoot/System/Library/LaunchAgents
$ sudo rm com.apple.AirPortBaseStationAgent.plist
override rw-r--r--  root/wheel restricted for com.apple.AirPortBaseStationAgent.plist? y
rm: com.apple.AirPortBaseStationAgent.plist: Operation not permitted
I haven’t seen this before.
Click to expand...
Those particular files are indeed SIP protected. You can see this by using
Code: 
ls -lO
(that's a capital letter O.)
SIP protected files show a "restricted" in the output of ls.
 
  • Like
Reactions: 997440
chrfr said:
Those particular files are indeed SIP protected. You can see this by using
Code: 
ls -lO
(that's a capital letter O.)
SIP protected files show a "restricted" in the output of ls.
Click to expand...

Interesting, it seems that every end folder has at least one restricted file. Even the ‘empty’ CoreServices folder has a hidden file with a restricted flag. Maybe SIP is the problem after all.
 
Deleting just the Quarantine folder works fine. No need to delete the "SystemMigration" root folder.

Had no problem emptying trash after. YMMV
 
adnbek said:
Deleting just the Quarantine folder works fine.
Click to expand...

Except when it doesn’t. :) When I attempt to do that, all the sub folders of QuarantineRoot are marked as ‘in use’. When I attempt to do it with sudo rm -r then I get the response above.

I think this might be something related to the beta. I had to install OS X with the installer again when the GM arrived, so naturally it would have moved all unnecessary components out of the way. That would explain why these files are flagged as restricted.
 
KALLT said:
I think this might be something related to the beta. I had to install OS X with the installer again when the GM arrived, so naturally it would have moved all unnecessary components out of the way. That would explain why these files are flagged as restricted.
Click to expand...

Just as a data point, I was never on any of the betas.... so you may be onto something there. It does not seem like the rest of us are not having this issue.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back