9

While using OS X El Capitan 10.11.x, is it safe to disable System Integrity Protection? There are all these additional apps that modify folders and the dock that I want to install but you have to disable rootless first.

Good idea or bad idea?

  • 3
    Welcome to Ask Different. Please define safe. SIP is there to secure you, so it's like disabling a "check brakes" light - that's never really "safe" unconditionally. – bmike Dec 11 '15 at 20:12
  • 2
    What files do those apps want to chnage - I would suggest that they are not well written as SIP only protects directories that Apple should write to (There are exceptions but very few) – mmmmmm Dec 11 '15 at 20:17
  • @Mark I don't know but these are apps that give you more detail in your finder or additional options for your dock. Things that prior to SIP were OK to do. But I guess Apple thought it was bad so in the last few OS's they enforced SIP. Just wondering how dangerous it is to deactivate something like that to have more power user features. – Micro Dec 11 '15 at 22:26
  • It is on a case by case basis - and wether you think a malicious app can do you damage or do you trust the apps - SIP I think cuts down on support issues so that only those who can calculate the risks should break it – mmmmmm Dec 12 '15 at 0:03
4

If you disable SIP you'll get the same level of protection as you had with OS X versions before El Capitan. Whether this is enough for your needs it something only you can decide.

OTOH it's not that much trouble to disable SIP briefly to chance a protected part of the system. If you want to be on the safe side, disconnect from any networks while you do this.

| improve this answer | |
  • Is it possible to disable SIP, install whatever program (while disconnected from any networks), and then once the program is installed, enable SIP again? Or would the program no longer function then? – Micro Dec 12 '15 at 16:46
  • 3
    Short answer: yes. Longer answer: it depends on the application – nohillside Dec 12 '15 at 18:37
0

I felt like it had a negative impact on the battery life of my macbook pro(around 300 cycle counts but not more than 300).After I disabled SIP, I was hardly getting five hours of battery. Few days ago, I enabled it, and it's back to normal.

About the safety issue of the core system file :If you know what you're doing, you should be fine. The following link should help you more about the SIP. http://www.imore.com/el-capitan-system-integrity-protection-helps-keep-malware-away

| improve this answer | |
  • 2
    Answers on Ask Different need to be more than just a link and a recommendation to look where it points to. It's okay to include a link, but please summarize or excerpt it in the answer. The idea is to make the answer stand alone. – nohillside Apr 19 '16 at 19:51
  • 1
    “If you know what you’re doing, you should be fine.” No, not really, because you don’t control whether the software is acting maliciously or not. I have 35 years of experience in software engineering. I’m leaving SIP on. – Lloyd Sargent Feb 24 '17 at 1:36
  • @Bishwa K. Thapa "I felt" is not very scientific now, is it?. One either knows, or doesn't know. One either has FACTS or spreads rumours and mis-information and fake news. On the same token: I disabled SIP on HighSierra and I felt my 8-year-old macbook was superfast. And also I felt that it avoided all those boot delays I experienced after upgrading to HighSierra (over 10 mins). It also enabled me to delete all the apple-phone-home, bloatware and other *ware AppleInc installed on my computer without asking me and expects me to host it without being able to stop it because of ... hmm SIP. – bliako Feb 24 at 17:28
  • btw, my 40 years experience on software engineering and 50 years experience on Life enable me to know for sure when someone takes the mickey and to know that a software vendor does not, I repeat, does not need to call its offices every time I reboot, login, press a key, send an email or use the spellchecker. This is spying on individuals like what totalitarian regimes used to do or still do. We think we are freer than 100 years ago only to have a big corporation come and snatch all these back? No way. And yes I bought this computer with my money. It's mine now, not Apple's. SIP lol – bliako Feb 24 at 17:36
  • For example netstat -a showed me that my computer was connected to 17.57.146.69 which is an IP belonging to Apple at Cupertino, CA, USA. Using port 5223 which is generally used for "Apple Push Notification Services". I tried to disable this "service" (from hell) but with SIP on it was impossible. I had to go to the recovery console (reboot with R pressed) in order to get rid of it. I do not want Apple Inc or any other Inc. to push me anything. Fullstop. – bliako Feb 24 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .