While using OS X El Capitan 10.11.x, is it safe to disable System Integrity Protection? There are all these additional apps that modify folders and the dock that I want to install but you have to disable rootless first.
Good idea or bad idea?
-
4Welcome to Ask Different. Please define safe. SIP is there to secure you, so it's like disabling a "check brakes" light - that's never really "safe" unconditionally.– bmike ♦Commented Dec 11, 2015 at 20:12
-
2What files do those apps want to chnage - I would suggest that they are not well written as SIP only protects directories that Apple should write to (There are exceptions but very few)– mmmmmmCommented Dec 11, 2015 at 20:17
-
@Mark I don't know but these are apps that give you more detail in your finder or additional options for your dock. Things that prior to SIP were OK to do. But I guess Apple thought it was bad so in the last few OS's they enforced SIP. Just wondering how dangerous it is to deactivate something like that to have more power user features.– MicroCommented Dec 11, 2015 at 22:26
-
1It is on a case by case basis - and wether you think a malicious app can do you damage or do you trust the apps - SIP I think cuts down on support issues so that only those who can calculate the risks should break it– mmmmmmCommented Dec 12, 2015 at 0:03
Add a comment
|
3 Answers
If you disable SIP you'll get the same level of protection as you had with OS X versions before El Capitan. Whether this is enough for your needs it something only you can decide.
OTOH it's not that much trouble to disable SIP briefly to chance a protected part of the system. If you want to be on the safe side, disconnect from any networks while you do this.
answered Dec 12, 2015 at 7:31
-
1Is it possible to disable SIP, install whatever program (while disconnected from any networks), and then once the program is installed, enable SIP again? Or would the program no longer function then?– MicroCommented Dec 12, 2015 at 16:46
-
3Short answer: yes. Longer answer: it depends on the application– nohillside ♦Commented Dec 12, 2015 at 18:37
I felt like it had a negative impact on the battery life of my macbook pro(around 300 cycle counts but not more than 300).After I disabled SIP, I was hardly getting five hours of battery. Few days ago, I enabled it, and it's back to normal.
About the safety issue of the core system file :If you know what you're doing, you should be fine. The following link should help you more about the SIP. http://www.imore.com/el-capitan-system-integrity-protection-helps-keep-malware-away
-
2Answers on Ask Different need to be more than just a link and a recommendation to look where it points to. It's okay to include a link, but please summarize or excerpt it in the answer. The idea is to make the answer stand alone.– nohillside ♦Commented Apr 19, 2016 at 19:51
-
2“If you know what you’re doing, you should be fine.” No, not really, because you don’t control whether the software is acting maliciously or not. I have 35 years of experience in software engineering. I’m leaving SIP on. Commented Feb 24, 2017 at 1:36
-
1@Bishwa K. Thapa "I felt" is not very scientific now, is it?. One either knows, or doesn't know. One either has FACTS or spreads rumours and mis-information and fake news. On the same token: I disabled SIP on HighSierra and I felt my 8-year-old macbook was superfast. And also I felt that it avoided all those boot delays I experienced after upgrading to HighSierra (over 10 mins). It also enabled me to delete all the apple-phone-home, bloatware and other *ware AppleInc installed on my computer without asking me and expects me to host it without being able to stop it because of ... hmm SIP.– bliakoCommented Feb 24, 2020 at 17:28
-
1btw, my 40 years experience on software engineering and 50 years experience on Life enable me to know for sure when someone takes the mickey and to know that a software vendor does not, I repeat, does not need to call its offices every time I reboot, login, press a key, send an email or use the spellchecker. This is spying on individuals like what totalitarian regimes used to do or still do. We think we are freer than 100 years ago only to have a big corporation come and snatch all these back? No way. And yes I bought this computer with my money. It's mine now, not Apple's. SIP lol– bliakoCommented Feb 24, 2020 at 17:36
-
1For example
netstat -ashowed me that my computer was connected to 17.57.146.69 which is an IP belonging to Apple at Cupertino, CA, USA. Using port 5223 which is generally used for "Apple Push Notification Services". I tried to disable this "service" (from hell) but with SIP on it was impossible. I had to go to the recovery console (reboot with R pressed) in order to get rid of it. I do not want Apple Inc or any other Inc. to push me anything. Fullstop.– bliakoCommented Feb 24, 2020 at 17:45
It is not safe to disable SIP. It is there to keep external apps from modifying system files, and once it has been disabled nothing short of a reinstall of the whole OS from external media can rectify this.
Once system files have been modified, even once, an attacker could have corrupted and infected your whole system, and turning it back on will not change this, as the damage has been done.
To be fair, Windows essentially allows the same thing every time you click yes to install any program(grants admin access to all files), but this doesn't make it more ok. That being said, I have installed dozens of programs from the internet on Windows and I have been (as far as I know) fine.
SIP is essentially a level of privilege above sudo. If you need to disable it, do so, but don't fool yourself: it is not secure.
answered Dec 11, 2020 at 3:12
