3

I have a script that I call from Terminal to boot into my Windows partition:

#! /bin/bash
sudo bless -mount "/Volumes/BOOTCAMP" -legacy -setBoot
sudo reboot

After updating to El Capitan (10.11.1) I can’t use it anymore. The error message says something about being unable to set a disk property, so I’m guessing this is related to the security features that were added in this update.

2

You can't set the bootable disk with bless if System Integrity Protection is enabled. This is because bless writes to NVRAM, which is prohibited by SIP. This is why System Preferences → Startup Disk is able to set the startup disk, but other binaries are not.

To disable System Integrity Protection, you can do the following:

  1. Boot into the Recovery HD by restarting whilst holding ⌘R.
  2. Open Terminal (from the Utilities menu).
  3. Run the following command in Terminal:

    csrutil disable
    
  4. Restart.

Source: Disable OS X El Capitan Rootless and permit write actions to System Integrity Protection locations

3
  • When should I be concerned about having SIP disabled? – Sean Haugh Dec 30 '15 at 15:47
  • @Sean It allows apps the ability to write to /System, the NVRAM and inject code into other running processes, given your administrator password (i.e. root). It's new in El Capitan and SIP disabled was the state of OS X in Yosemite and earlier. As System Preferences is codesigned with Apple's certificate, it bypasses SIP, thus scripting this GUI may be preferable to avoid disabling SIP. – grg Dec 30 '15 at 15:54
  • 1
    I would avoid disabling SIP and finding a different way. Bless is not the only too to set the startup disk and using something like automator or applescript will most likely be supported by apple, which is beneficial in the long run since updates are less likely to break it. – John Keates Dec 30 '15 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .