Can't delete the sleepimage on high sierra

[hdoria]

sudo rm /private/var/vm/sleepimage override rw------T root/wheel for /private/var/vm/sleepimage? yes rm: /private/var/vm/sleepimage: Operation not permitted

The same command works for macOS Sierra

[jesusmonterob]

I have the same problem here. Anyone knows how to fix it?

[justincbagley]

Hi, I am also having this problem, for example:

sudo rm:

Justin:vm justinbagley$ sudo rm -rf /var/vm/sleepimage rm: /var/vm/sleepimage: Operation not permitted

OR

rm:

Justin:~ justinbagley$ cd /var/vm/ Justin:vm justinbagley$ ls sleepimage swapfile0 Justin:vm justinbagley$ rm ./sleepimage override rw------T root/wheel for ./sleepimage? y rm: ./sleepimage: Operation not permitted

Permissions on sleepimage are read and write:

Justin:~ justinbagley$ ls -lod sleepimage -rw------T 1 root 1073741824 Nov 21 08:02 sleepimage

Could someone please explain how to fix this issue and allow sudo access to not just read and write in var, but also remove files? I worry this may affect other files that I will need to sudo rm. ~ J

[DeadWriter]

Anyone get a solution on this one? I'm getting the same in Sierra 10.12.6 also.

[chdiza]

I'm guessing that probably in High Sierra the sleepimage was put under SIP control. If that's the case, there's nothing you can do unless you disable SIP.

[justincbagley]

Excuse my ignorance, but what is SIP?

[chdiza]

System Integrity Protection.

[markstachowski]

1. reboot into Recovery mode
2. open terminal
3. type: csrutil disable
4. reboot
5. try to remove the image again with SIP disabled

Read: https://www.imore.com/el-capitan-system-integrity-protection-helps-keep-malware-away

[hdoria]

@chdiza is right. In High Sierra the sleepimage was put under SIP control. Just follow @markstachowski instructions.

[sandeepkalra]

I was able to select "EJECT" it (just as dmg or drive). Hope this helps someone!

[mikedvzo]

Thanks worked like a champ 😊

[mikedvzo]

Only temporarily and now it is back again. Looks like there is no way to stop it that I can tell.

[starast]

You must first disable hibernation by executing:

sudo pmset -a hibernatemode 0

[mikedvzo]

The problem I ran into on a MacBook Pro is every time you reboot with 10.13 the system resets the Hibernation mode to 3. In addition the swapfile is also in the VM mount and if you force eject and the swapfile is being utilized the system sill probably crash.

[chdiza]

on a MacBook Pro is every time you reboot with 10.13 the system resets the Hibernation mode to 3.

It doesn't do that on mine. It does recreate a sleepimage upon startup despite being in hibernate mode 0. I reported this to Apple and they haven't done anything about it.

[ktgvv]

I'm late to the party... It's probably the SIP. Almost each time the shell returns '${command}: ${path}: Operation not permitted', the SIP prevents writing. See more here, there, here and there, and here also.

[HenkPoley]

It seems like in normal circumstances the sleepimage is deleted on reboot. Or at least I couldn't find it back in /Volumes/Macintosh HD/private/var/vm during a recovery mode boot (hold CMD+R during bootup). The sleepimage was there while booted into normal macOS mode.

It might be wise to do a filesystem scan with Disk Utility (or just /sbin/fsck -fy from single user mode, hold CMD+S during bootup). And to do the usual SMC + PRAM reset dance.

[chopshopstore]

I think it worked for me. I did sudo pmset -a hibernatemode 0 and now it says the file doesn’t exist.