Apple’s System Integrity Protection (SIP) is a feature that helps protect your Mac from unauthorized access. When enabled, SIP prevents unauthorized users from damaging or even losing data on your computer. However, there are a few reasons why you might want to disable SIP on your Mac. First, disabling SIP can help improve the security of your computer. If someone is able to gain access to your computer without being authorized, they may be able to do more damage than if they had access to SIP enabled. Additionally, disabling SIP can save you time and money. By not having to worry about protecting your data with SIP enabled, you can save yourself time and money in the long run. If you decide that you want to disable System Integrity Protection on your Mac, be sure to do so in a way that is safe and secure. You can do this by following these steps:
- Open System Preferences and select the Security tab.
- In the Security section, select the option that corresponds with the level of protection you want to disable for your Mac: General or User Level . 3) Click on the Disable button next to each of the levels of protection that you have selected in step 2.
Mac OS X 10.11 El Capitan protects system files and processes with a new feature named System Integrity Protection. SIP is a kernel-level feature that limits what the “root” account can do.
This is a great security feature, and almost everyone — even “power users” and developers — should leave it enabled. But, if you really do need to modify system files, you can bypass it.
What is System Integrity Protection?
RELATED: What Is Unix, and Why Does It Matter?
On Mac OS X and other UNIX-like operating systems, including Linux, there’s a “root” account that traditionally has full access to the entire operating system. Becoming the root user — or gaining root permissions — gives you access to the entire operating system and the ability to modify and delete any file. Malware that gains root permissions could use those permissions to damage and infect the low-level operating system files.
Type your password into a security dialog and you’ve given the application root permissions. This traditionally allows it to do anything to your operating system, although many Mac users may not have realized this.
System Integrity Protection — also known as “rootless” — functions by restricting the root account. The operating system kernel itself puts checks on the root user’s access and won’t allow it to do certain things, such as modify protected locations or inject code into protected system processes. All kernel extensions must be signed, and you can’t disable System Integrity Protection from within Mac OS X itself. Applications with elevated root permissions can no longer tamper with system files.
You’re most likely to notice this if you attempt to write to one of the following directories:
/System /bin /usr /sbin
OS X just won’t allow it, and you’ll see an “Operation not permitted” message. OS X also won’t allow you to mount another location over one of these protected directories, so there’s no way around this.
The full list of protected locations is found at /System/Library/Sandbox/rootless.conf on your Mac. It includes files like the Mail.app and Chess.app apps included with Mac OS X, so you can’t remove these — even from the command line as the root user. This also means that malware can’t modify and infect those applications, however.
Not coincidentally, the “repair disk permissions” option in Disk Utility — long used for troubleshooting various Mac problems — has now been removed. System Integrity Protection should prevent crucial file permissions from being tampered with, anyway. The Disk Utility has been redesigned and still has a “First Aid” option for repairing errors, but includes no way to repair permissions.
How to Disable System Integrity Protection
Warning: Don’t do this unless you have a very good reason to do so and know exactly what you’re doing! Most users won’t need to disable this security setting. It’s not intended to prevent you from messing with the system — it’s intended to prevent malware and other badly behaved programs from messing with the system. But some low-level utilities may only function if they have unrestricted access.
RELATED: 8 Mac System Features You Can Access in Recovery Mode
The System Integrity Protection setting isn’t stored in Mac OS X itself. Instead, it’s stored in NVRAM on each individual Mac. It can only be modified from the recovery environment.
To boot into recovery mode, restart your Mac and hold Command+R as it boots. You’ll enter the recovery environment. Click the “Utilities” menu and select “Terminal” to open a terminal window.
Type the following command into the terminal and press Enter to check the status:
You’ll see whether System Integrity Protection is enabled or not.
To disable System Integrity Protection, run the following command:
If you decide you want to enable SIP later, return to the recovery environment and run the following command:
Restart your Mac and your new System Integrity Protection setting will take effect. The root user will now have its full, unrestricted access to the entire operating system and every file.
If you previously had files stored in these protected directories before you upgraded your Mac to OS X 10.11 El Capitan, they haven’t been deleted. You’ll find them moved to the /Library/SystemMigration/History/Migration-(UUID)/QuarantineRoot/ directory on your Mac.
Image Credit: Shinji on Flickr
