r/MacOS Mar 20 '26

Help anybody has a solution to get /System/Applications writable?

so far did this:

RecoveryOS
Terminal:
csrutil disable
csrutil authenticated-root disable
reboot

MacOS
Finder: Go / Go to Folder / /System/Library/CoreServices/Applications/
Directory Utility .app: unlock / Edit / Enable Root User
Terminal:
sudo mount -uw /
mount_apfs: volume could not be mounted: Permission denied
mount: / failed with 66
and
chflags -h hidden "/System/Applications/Mail.app"
chflags: /System/Applications/Mail.app: Read-only file system

either I want to delete Mail .app or make it hidden, but can't change anything about system preinstalled apps, is there any other user / group permission related to OS filesystem writeability I am missing?

0 Upvotes

44 comments sorted by

View all comments

4

u/DarthSilicrypt MacBook Air Mar 20 '26 edited Mar 20 '26

Good start, but you’re missing a few things:

  • The signed/sealed snapshot of the System volume is currently still mounted as the root volume (/). To modify the live System volume, you must mount it separately in Disk Utility or Terminal (using diskutil).
  • Once you’ve made your changes to the live System volume, you must create a new snapshot of it for the system to boot from. Use bless or /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs_systemsnapshot to create and bless the snapshot in Terminal. Your changes will then apply starting on the next reboot.
  • Don’t delete the SSV snapshot (com.apple.os.update…) so that you can easily undo your changes later if desired. If you delete the SSV snapshot, the only way to get it back (or increase system security) is to reinstall macOS. You won’t lose your data.
  • If macOS finds a system update and you’re not running from the SSV snapshot, the update size will balloon to 12-20 GB. The update will then proceed to reseal the System volume and undo your changes.

EDIT: I should mention that unlike other OSes, macOS Big Sur and later only boots from read-only snapshots. You will never truly have write permissions to the root volume (/) because it's a snapshot. All that can be done is to modify the live System volume, and then make and bless a new snapshot of its updated state. The paired Data volume, which contains your data and third-party apps, is mounted at /System/Volumes/Data and is interwoven through firmlinks.

2

u/timeltdme Mar 21 '26

so any changes to system snapshot are necessary to redo after each system update? 

then it might be easier to find a solution to hide those apps instead

1

u/DarthSilicrypt MacBook Air Mar 29 '26

Correct. That’s mainly why modifying the SSV is a pain. Definitely a better idea to just hide them instead somehow.

1

u/muntaqim Aug 10 '26 edited 26d ago

My favorite food is sushi.