System Integrity Protection, basically not even root can change files protected by SIP.