System Integrity Protection, or SIP, is a security feature found on many Macs that can make it difficult to remove malware or restore files from a backup. While SIP is useful in preventing unauthorized access to your computer, it can also be a hindrance if you need to repair or restore your system. In this article, we’ll show you how to disable SIP on a Mac and why you should do so if you ever need to perform these tasks. First, let’s take a look at what SIP is and what it does. When enabled, SIP locks down your computer by preventing unauthorized changes to the operating system and installed applications. This means that if you want to install an application that wasn’t originally included on your Mac or make changes to the operating system, you’ll have to go through Apple first. While this protection is important for keeping your computer safe from unauthorized access, it can also be difficult if you need to repair or restore your system. For example, if your Mac has been infected with malware and you need to remove it completely before restoring it back to its original state, disabling SIP may not be possible. In these cases, using a third-party tool like Disk Utility may be the best option for restoring your system without any issues. So why should you disable SIP on a Mac? There are several reasons: first of all, disabling SIP makes it easier for you to make changes to the operating system and installed applications; secondly, removing malware often requires making changes that are not allowed by SIP; and finally, disabling SIP can sometimes help when repairing or restoring systems. If any of these reasons apply to you and disabling Sip isn’t possible or doesn’t work as intended then don’t worry – we have other articles that will help guide you through the process of repairing or restoring your Mac! ..
Mac OS X 10.11 El Capitan protects system files and processes with a new feature named System Integrity Protection. SIP is a kernel-level feature that limits what the “root” account can do.
This is a great security feature, and almost everyone — even “power users” and developers — should leave it enabled. But, if you really do need to modify system files, you can bypass it.
What is System Integrity Protection?
RELATED: What Is Unix, and Why Does It Matter?
On Mac OS X and other UNIX-like operating systems, including Linux, there’s a “root” account that traditionally has full access to the entire operating system. Becoming the root user — or gaining root permissions — gives you access to the entire operating system and the ability to modify and delete any file. Malware that gains root permissions could use those permissions to damage and infect the low-level operating system files.
Type your password into a security dialog and you’ve given the application root permissions. This traditionally allows it to do anything to your operating system, although many Mac users may not have realized this.
System Integrity Protection — also known as “rootless” — functions by restricting the root account. The operating system kernel itself puts checks on the root user’s access and won’t allow it to do certain things, such as modify protected locations or inject code into protected system processes. All kernel extensions must be signed, and you can’t disable System Integrity Protection from within Mac OS X itself. Applications with elevated root permissions can no longer tamper with system files.
You’re most likely to notice this if you attempt to write to one of the following directories:
/System /bin /usr /sbin
OS X just won’t allow it, and you’ll see an “Operation not permitted” message. OS X also won’t allow you to mount another location over one of these protected directories, so there’s no way around this.
The full list of protected locations is found at /System/Library/Sandbox/rootless.conf on your Mac. It includes files like the Mail.app and Chess.app apps included with Mac OS X, so you can’t remove these — even from the command line as the root user. This also means that malware can’t modify and infect those applications, however.
Not coincidentally, the “repair disk permissions” option in Disk Utility — long used for troubleshooting various Mac problems — has now been removed. System Integrity Protection should prevent crucial file permissions from being tampered with, anyway. The Disk Utility has been redesigned and still has a “First Aid” option for repairing errors, but includes no way to repair permissions.
How to Disable System Integrity Protection
Warning: Don’t do this unless you have a very good reason to do so and know exactly what you’re doing! Most users won’t need to disable this security setting. It’s not intended to prevent you from messing with the system — it’s intended to prevent malware and other badly behaved programs from messing with the system. But some low-level utilities may only function if they have unrestricted access.
RELATED: 8 Mac System Features You Can Access in Recovery Mode
The System Integrity Protection setting isn’t stored in Mac OS X itself. Instead, it’s stored in NVRAM on each individual Mac. It can only be modified from the recovery environment.
To boot into recovery mode, restart your Mac and hold Command+R as it boots. You’ll enter the recovery environment. Click the “Utilities” menu and select “Terminal” to open a terminal window.
Type the following command into the terminal and press Enter to check the status:
You’ll see whether System Integrity Protection is enabled or not.
To disable System Integrity Protection, run the following command:
If you decide you want to enable SIP later, return to the recovery environment and run the following command:
Restart your Mac and your new System Integrity Protection setting will take effect. The root user will now have its full, unrestricted access to the entire operating system and every file.
If you previously had files stored in these protected directories before you upgraded your Mac to OS X 10.11 El Capitan, they haven’t been deleted. You’ll find them moved to the /Library/SystemMigration/History/Migration-(UUID)/QuarantineRoot/ directory on your Mac.
Image Credit: Shinji on Flickr
