It appears that the answer to this issue might be found in the ownership of the Caches files. The following is the output from a scan for files owned by root:
App container root: file:///var/mobile/Containers/Data/Application/A155B86A-E9FA-4566-927A-9AF2B0DC0746/
❌ Could not check /private/var/mobile/Containers/Data/Application/A155B86A-E9FA-4566-927A-9AF2B0DC0746/.com.apple.mobile_container_manager.metadata.plist: The file “.com.apple.mobile_container_manager.metadata.plist” couldn’t be opened because you don’t have permission to view it.
🚨 Root-owned item found: /private/var/mobile/Containers/Data/Application/A155B86A-E9FA-4566-927A-9AF2B0DC0746/Library/Caches/com.GeorgePurvis.Photography.FrameItVision
NSFileOwnerAccountID: 0
NSFileGroupOwnerAccountName: mobile
NSFileReferenceCount: 4
NSFileType: NSFileTypeDirectory
NSFileExtensionHidden: 0
NSFileSystemNumber: 16777226
NSFileAppendOnly: 0
NSFileGroupOwnerAccountID: 501
NSFileOwnerAccountName: root
NSFileImmutable: 0
NSFileSystemFileNumber: 17595554
NSFileSize: 128
NSFileModificationDate: 2025-04-28 17:02:47 +0000
NSFileCreationDate: 2025-04-28 17:02:40 +0000
NSFilePosixPermissions: 493
🚨 Root-owned item found: /private/var/mobile/Containers/Data/Application/A155B86A-E9FA-4566-927A-9AF2B0DC0746/Library/Caches/com.GeorgePurvis.Photography.FrameItVision/com.apple.metalfe
NSFileGroupOwnerAccountName: mobile
NSFileImmutable: 0
NSFileAppendOnly: 0
NSFilePosixPermissions: 493
NSFileType: NSFileTypeDirectory
NSFileSystemNumber: 16777226
NSFileGroupOwnerAccountID: 501
NSFileExtensionHidden: 0
NSFileReferenceCount: 2
NSFileSystemFileNumber: 17595555
NSFileSize: 96
NSFileOwnerAccountID: 0
NSFileOwnerAccountName: root
NSFileModificationDate: 2025-04-28 17:02:40 +0000
NSFileCreationDate: 2025-04-28 17:02:40 +0000
❌ Could not list contents of /private/var/mobile/Containers/Data/Application/A155B86A-E9FA-4566-927A-9AF2B0DC0746/SystemData: The file “SystemData” couldn’t be opened because you don’t have permission to view it.
Could this be the cause of the problem? I am unable to delete the root owned files in my sandbox.
How do directories and files become owned by root? [I certainly cannot do it from standard code.]
Why are these two files owned by root?
This is the ChatGPT code that scanned the app directory tree:
import Foundation
func checkForRootOwnedItems(at url: URL, indent: String = "") {
do {
let contents = try FileManager.default.contentsOfDirectory(at: url, includingPropertiesForKeys: nil)
for item in contents {
do {
let attributes = try FileManager.default.attributesOfItem(atPath: item.path)
if let ownerID = attributes[.ownerAccountID] as? NSNumber {
if ownerID.intValue == 0 {
// UID 0 is root
print("🚨 Root-owned item found: \(item.path)")
for (key, value) in attributes {
print("\(indent) \(key.rawValue): \(value)")
}
}
}
var isDir: ObjCBool = false
if FileManager.default.fileExists(atPath: item.path, isDirectory: &isDir),
isDir.boolValue {
// attempt to recurse
checkForRootOwnedItems(at: item, indent: indent + " ")
}
} catch {
// you couldn't even read this file or folder:
print("❌ Could not check \(item.path): \(error.localizedDescription)")
}
}
} catch {
// this directory itself couldn't be listed:
print("❌ Could not list contents of \(url.path): \(error.localizedDescription)")
}
}
// Usage:
if let rootURL = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask).first?
.deletingLastPathComponent()
.deletingLastPathComponent()
{
checkForRootOwnedItems(at: rootURL)
}
