Modifying Sealed System Volume

1. Open Terminal and run as sudo

sudo -i

Skip this step if you are reverting to default snapshot in recoveryOS.

2. Find out which volume to mount

mount

In macOS, the first volume with format /dev/disk?s?s1 is the system volume. In recoveryOS, the named volume with the (apfs,sealed) attribution is the system volume. Note down the disk?s? part.

3. Mount system volume

diskutil unmount force /dev/disk?s? mkdir /tmp/live_mount
mount -o nobrowse -t apfs /dev/disk?s? /tmp/live_mount

Replace disk?s? with the identifier you found in step 2.

4. Make changes in Finder

open /tmp/live_mount
open -a Finder

Skip this step if you are reverting to default snapshot in recoveryOS.

5(a). Create new snapshot

bless --mount /tmp/live_mount --bootefi --create-snapshot

5(b). Revert to default snapshot

bless --mount /tmp/live_mount --bootefi --last-sealed-snapshot

6. Unmount and restart

diskutil unmount force /tmp/live_mount
reboot