Issue in disabling SIP (rootless) in El Capitan

Question

I have just installed El Capitan and I immediately experimented some problems because of the new SIP mechanism. Some tools I need as well as some tweaks did not work anymore. So, I decided to turn it off using the Apple "official" procedure (boot to Recovery, csrutil disable, reboot).

Now all my tools etc. are back working again. But if I check the SIP status using the csrutil utility I get:

$  csrutil status
System Integrity Protection status: enabled (Custom Configuration).

Configuration:
    Apple Internal: disabled
    Kext Signing: disabled
    Filesystem Protections: disabled
    Debugging Restrictions: disabled
    DTrace Restrictions: disabled
    NVRAM Protections: disabled

    This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

The fact it says "status: enabled" is strange, but it does not worry me to much because, after, all the elements are disabled. I cannot rest easy with the sentence "...likely to break in the future and leave your machine in an unknown state".

Any ideas about this output?! Thanks in advance

Answer 1

If all functions listed are showing as being disabled, SIP is actually completely disabled; it’s just confusingly worded.

My friend had the same problem so I did some research online and found out that it is a bug. There is a bug report on this message; it is bug ID 22361698 and is cross-posted to Open Radar here:

https://openradar.appspot.com/radar?id=4932475130216448

In the above link it says to:

1. Boot to Recovery HD
2. Open Terminal
3. Run the following command: /usr/bin/csrutil disable

You should then receive the following output:

4. System Integrity Protection status: disabled.