1

I have just installed latest Xquartz and FSL imaging software. I noticed that there is a new symbolic link in /usr (i.e. /usr/X11R6) to /opt/X11. My understanding was that only Apple software could be certified/signed to modify /usr under the new SIP in El Capitan. I am certainly unable to modify /usr directly with sudo so SIP is turned on.

It definitely is new - I had a previous xquartz install with a /usr/X11 symlink created prior to El Capitan upgrade which remained in place. However, FSL needs a /usr/X11R6 symlink which I tried to create manually to no avail because of SIP.

After upgrading to latest Xquartz now I have both /usr/X11 and /usr/X11R6 symlinks. It's not a 'problem' but I'm not clear how it got there.

Can someone explain how this works?

Improve this question
3
  • Are you sure that the symlink is new? May be a leftover from a previous installation
    – nohillside ♦
    Commented Nov 24, 2015 at 16:16
  • I have the same symlinks here (also with a date after I've upgraded to 10.11) and just verified that the timestamp of the symlink can be changed with sudo touch -h /usr/X11 even with SIP active. So I still suspect that the X11R6 was there before, do you have TM (or other) backup from before the time you installed Xquartz.
    – nohillside ♦
    Commented Nov 25, 2015 at 9:02
  • Uh, but it didn't work for /usr/X11R6 which is shown as protected in ll -O /usr. But somehow it still got updated/touch by Xquartz. Mysterious...
    – nohillside ♦
    Commented Nov 25, 2015 at 9:07

2 Answers 2

Reset to default
1

SIP disables everything (including the kernel) from modifying the specified directories. Disable it if you want to modify /usr.

Improve this answer
2
  • The question is, with rootless on, how did Xquartz create the symlink?
    – Alan Shutko
    Commented Nov 24, 2015 at 15:49
  • @AlanShutko Apple may have allowed packages to modify stuff (maybe?).
    – At0micMutex
    Commented Nov 24, 2015 at 16:09
1

It is possible to add, remove or change SIP-protected files and directories via an installer package which is signed by Apple’s own certificate authority. This allows Apple to make changes to SIP-protected parts of the OS without needing to change the existing SIP protections.

Normally, this would exclude Developer ID certificates, but I'm betting Apple made an exception for this particular Developer ID certificate.

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .