How to Use the macOS chflags Command to Lock Files and Prevent Deletion

On macOS, setting standard POSIX read/write permissions (using chmod) is often not enough to protect critical system configurations or historical archives. Even if a file is marked as \”read-only,\” the root user (or a rogue sudo script) can easily override the permissions and delete the file. To mathematically lock a file at the filesystem level, making it physically impossible to delete, rename, or modify even by the system administrator, macOS engineers use the chflags (change flags) command.

Why Use the chflags Command?

The chflags command operates at a deeper level than standard Unix file permissions. It interacts directly with the APFS (Apple File System) or HFS+ metadata to set specific mathematical bit flags. When the uchg (user immutable) or schg (system immutable) flag is applied to a file, the macOS kernel mathematically blocks all write system calls directed at that inode. This means that rm -rf, Finder trash, and automated cleanup scripts will instantly fail to alter the file, providing absolute protection against accidental deletion or unauthorized tampering.

Step 1: Lock a File Using the Immutable Flag

The most common use of chflags is applying the \”user immutable\” (uchg) flag to a critical document.

1. Open the macOS Terminal (located in Applications > Utilities).
2. Identify the file you want to mathematically lock (e.g., archive.zip).
3. Run the following command:

chflags uchg archive.zip

1. Press Enter. The file is now mathematically locked. If you select it in Finder and press Delete, macOS will refuse the action. If you try to run rm archive.zip, the terminal will return an \”Operation not permitted\” error.

Step 2: Lock an Entire Directory Recursively

If you have an entire folder of finalized client projects that must never be altered, you can apply the immutable flag to the folder and all its mathematical contents simultaneously.

1. Use the -R (recursive) flag:

chflags -R uchg /path/to/Client_Projects/

Every single file and subfolder inside that directory is now locked at the kernel level.

Step 3: Unlock a File to Allow Edits

Because the kernel physically blocks all modifications, you must explicitly remove the mathematical flag before you can update or delete the file.

1. To remove the uchg flag, prepend the flag name with the word no:

chflags nouchg archive.zip

1. Press Enter. The APFS metadata is updated, the kernel block is lifted, and the file can once again be modified or deleted using standard commands or the Finder interface.

Step 4: Verify Which Files Are Locked

Standard ls -l commands do not show file flags. To see if a file is mathematically immutable, you must append a specific argument to the list command.

1. Run the list command with the -O (capital O) flag:

ls -lO archive.zip

1. The terminal will output the file properties. If the file is locked, you will clearly see uchg listed in the metadata columns next to the file size.

By mastering the chflags command, macOS administrators can enforce absolute data integrity and mathematically prevent accidental catastrophic data loss.