$ xattr /usr
com.apple.FinderInfo
com.apple.rootless
Running `sudo rm -rf /usr` fails.
$ sudo rm -rf /usr
rm: /usr: Operation not permitted
Here is a list of all of the `rootless` files and directories on my system. It appears to be mostly kext files, and Apple applications.
Locking the system down will make it a bit harder to shoot yourself in the foot. Besides the obvious advantage of reducing the attack surface of vulnerabilities.
A more harmless way to check: `sudo touch -a /usr`.
Can you turn off rootless during installation or is this post installation thing only?
Does rsync backup continue to work with rootless? I have a feeling that booting from external partition and restoring from backup won't work for system files with rootless attribute on them.