While using OS X El Capitan 10.11.x, is it safe to disable System Integrity Protection? There are all these additional apps that modify folders and the dock that I want to install but you have to disable rootless first.

Good idea or bad idea?

  • 4
    Welcome to Ask Different. Please define safe. SIP is there to secure you, so it's like disabling a "check brakes" light - that's never really "safe" unconditionally.
    – bmike
    Dec 11, 2015 at 20:12
  • 2
    What files do those apps want to chnage - I would suggest that they are not well written as SIP only protects directories that Apple should write to (There are exceptions but very few)
    – mmmmmm
    Dec 11, 2015 at 20:17
  • @Mark I don't know but these are apps that give you more detail in your finder or additional options for your dock. Things that prior to SIP were OK to do. But I guess Apple thought it was bad so in the last few OS's they enforced SIP. Just wondering how dangerous it is to deactivate something like that to have more power user features.
    – Micro
    Dec 11, 2015 at 22:26
  • 1
    It is on a case by case basis - and wether you think a malicious app can do you damage or do you trust the apps - SIP I think cuts down on support issues so that only those who can calculate the risks should break it
    – mmmmmm
    Dec 12, 2015 at 0:03

3 Answers 3


If you disable SIP you'll get the same level of protection as you had with OS X versions before El Capitan. Whether this is enough for your needs it something only you can decide.

OTOH it's not that much trouble to disable SIP briefly to chance a protected part of the system. If you want to be on the safe side, disconnect from any networks while you do this.

  • Is it possible to disable SIP, install whatever program (while disconnected from any networks), and then once the program is installed, enable SIP again? Or would the program no longer function then?
    – Micro
    Dec 12, 2015 at 16:46
  • 3
    Short answer: yes. Longer answer: it depends on the application
    – nohillside
    Dec 12, 2015 at 18:37

I felt like it had a negative impact on the battery life of my macbook pro(around 300 cycle counts but not more than 300).After I disabled SIP, I was hardly getting five hours of battery. Few days ago, I enabled it, and it's back to normal.

About the safety issue of the core system file :If you know what you're doing, you should be fine. The following link should help you more about the SIP. http://www.imore.com/el-capitan-system-integrity-protection-helps-keep-malware-away

  • 2
    Answers on Ask Different need to be more than just a link and a recommendation to look where it points to. It's okay to include a link, but please summarize or excerpt it in the answer. The idea is to make the answer stand alone.
    – nohillside
    Apr 19, 2016 at 19:51
  • 2
    “If you know what you’re doing, you should be fine.” No, not really, because you don’t control whether the software is acting maliciously or not. I have 35 years of experience in software engineering. I’m leaving SIP on. Feb 24, 2017 at 1:36
  • 1
    @Bishwa K. Thapa "I felt" is not very scientific now, is it?. One either knows, or doesn't know. One either has FACTS or spreads rumours and mis-information and fake news. On the same token: I disabled SIP on HighSierra and I felt my 8-year-old macbook was superfast. And also I felt that it avoided all those boot delays I experienced after upgrading to HighSierra (over 10 mins). It also enabled me to delete all the apple-phone-home, bloatware and other *ware AppleInc installed on my computer without asking me and expects me to host it without being able to stop it because of ... hmm SIP.
    – bliako
    Feb 24, 2020 at 17:28
  • 1
    btw, my 40 years experience on software engineering and 50 years experience on Life enable me to know for sure when someone takes the mickey and to know that a software vendor does not, I repeat, does not need to call its offices every time I reboot, login, press a key, send an email or use the spellchecker. This is spying on individuals like what totalitarian regimes used to do or still do. We think we are freer than 100 years ago only to have a big corporation come and snatch all these back? No way. And yes I bought this computer with my money. It's mine now, not Apple's. SIP lol
    – bliako
    Feb 24, 2020 at 17:36
  • 1
    For example netstat -a showed me that my computer was connected to which is an IP belonging to Apple at Cupertino, CA, USA. Using port 5223 which is generally used for "Apple Push Notification Services". I tried to disable this "service" (from hell) but with SIP on it was impossible. I had to go to the recovery console (reboot with R pressed) in order to get rid of it. I do not want Apple Inc or any other Inc. to push me anything. Fullstop.
    – bliako
    Feb 24, 2020 at 17:45

It is not safe to disable SIP. It is there to keep external apps from modifying system files, and once it has been disabled nothing short of a reinstall of the whole OS from external media can rectify this.

Once system files have been modified, even once, an attacker could have corrupted and infected your whole system, and turning it back on will not change this, as the damage has been done.

To be fair, Windows essentially allows the same thing every time you click yes to install any program(grants admin access to all files), but this doesn't make it more ok. That being said, I have installed dozens of programs from the internet on Windows and I have been (as far as I know) fine.

SIP is essentially a level of privilege above sudo. If you need to disable it, do so, but don't fool yourself: it is not secure.

  • Actually, SIP can be re-enabled without having to reinstall the OS Dec 11, 2020 at 3:25
  • 1
    @Twlv I think Jacob's point is turning SIP back on doesn't revalidate the filesystem and an attacker's filesystem changes will be persisted.
    – grg
    Dec 11, 2020 at 8:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .