Editing the /System/Library/LaunchDaemons/com.apple.pfctl.plist file

Question

I need to vim the file found at /System/Library/LaunchDaemons/com.apple.pfctl.plist but the permissions will not allow it. Even when I run sudo vim /System/Library/LaunchDaemons/com.apple.pfctl.plist and enter my password, VIM throws me a warning and says that I'm editing a readonly file. Any ideas how to do this?

I'm running OS X 10.11 El Capitain.

Answer 1

Some paths and applications in El Capitan are protected by System Integrity Protection. Even root can't modify the files. You first have to disable SIP before editing or modifying them.

1. Reboot your Mac to Recovery Mode by restarting your computer and holding down CommandR until the Apple logo appears on your screen.
2. Click Utilities -> Terminal.
3. In the Terminal window, enter in csrutil disable and press Enter.
4. Restart your Mac
5. Modify the file(s)
6. Reboot your Mac to Recovery Mode by restarting your computer and holding down CommandR until the Apple logo appears on your screen.
7. Click Utilities -> Terminal.
8. In the Terminal window, enter in csrutil enable and press Enter.
9. Restart your Mac

Answer 2

If you are trying to enable PF at startup, you can also try the following*.

In System Preferences / Security & Privacy / Firewall Options..., check "Enable stealth mode" and turn on Firewall.

Somehow this enables PF. You can check by running sudo pfctl -s info.

*Tested on High Sierra and Mojave

Answer 3

In Mac Catalina 10.15.6, I couldn't edit com.apple.pfctl.plist after running csrutil disable and restart OS.

I restart to Recover mode -> execute csrutil disable in terminal -> Restart to Recover mode -> then mount OS Volume by Disk util -> then edit com.apple.pfctl.plist in terminal -> then executed csrutil disable -> restart to normal mode -> done