13

Before you respond that this isn't possible, hear me out. I have a Mac Pro 4,1 (with 5,1 firmware), running MacOS Sierra. I want to disable System Integrity Protection (otherwise known as SIP), but have run into a snag. I don't have a flashed graphics card, so I can't see my boot screen (or recovery mode or safe mode) on my computer. Therefore I can't see how to disable SIP on my computer. I have tried:

Boot Mac Pro into target disk mode and connect MacBook Air (OS X 10.9 - pre-SIP) via FireWire To MP. Boot MBA from Mac Pro's recovery partition, (MacOS 10.12 recovery). Disable SIP, reboot. Doing this worked on the MBA. But when I turned on the Mac Pro again, SIP was enabled. I assumed that because of this, the SIP disable was linked to the hardware.

Question 1: Is this assumption correct?

Question 2: is it possible to disable the SIP without using the graphics card in the Mac Pro? I have an iMac running MacOS Sierra and a MBA running OS X 10.9 at my disposal. Possible solutions can include (but don't have to be limited to): ssh, screensharing, target disk mode).

I would appreciate any help. Please post questions as comments and feel free to suggest edits. Thank you!

Improve this question
5
  • Sorry, just re-read your question. Are you saying that your Mac Pro is not connected to any sort of a display? Have you got any way of seeing what's on the screen of the Mac Pro? If not, do you have a way to install software on the Mac Pro? Also, does your iMac support Target Display Mode?
    – Monomeeth ♦
    Nov 20, 2016 at 3:54
  • I have a screen, but it only works with a driver, so it doesn't work until the driver has started (so not during boot or during boot key options and not after PRAM resets). It's also set up with MacOS Server, ssh, screen-sharing, file-sharing, etc.
    – NoahL
    Nov 20, 2016 at 3:57
  • @Monomeeth in addition, I found someone citing an Apple developer page which states that the SIP status is stored in the computer's NVRAM, so I'd need to the MP to run the recovery mode. SSH refuses connections in recovery mode and (unfortunately) I can't do it blindly in single user mode because you cannot disable SIP in single user mode.
    – NoahL
    Nov 20, 2016 at 5:35
  • I do not understand what "Flashed" graphic card is - but all Mac Pros I've seen have some kind of internal Graphics card you receive with the machine - which works fine in all circumstances. Beyond that - my own experience with a hardware-failing graphics card (on my very old 2004 iMac) booting into "safe mode" or "single user mode" were ALWAYS possible, and screen was visible - because in these modes Mac doesn't rely on any card-specific or card-driver-specific features - only the very basic stuff. You'll see a very sad text-only unix-face Mac. There, among other things, you can turn off SIP
    – Motti Shneor
    Nov 24, 2016 at 18:19
  • 1
    @MottiShneor I received the machine without any graphics card. On the graphics card that I have (bought after the computer), graphics would only work AFTER boot because the graphics would only work with the GPU company's driver (a driver that initialized after startup). Also, this Apple Dev Forum states that you can't disable SIP from Single User Mode: forums.developer.apple.com/thread/29517
    – NoahL
    Nov 24, 2016 at 18:24

4 Answers 4

Reset to default
11

Edit: to answer your actual question, you can't do it from anywhere except Recovery Mode, so anything you do must be done from there.

Tested on a similar 4,1 upgraded to 5,1 [but I have a flashed graphics card so I could see what I was doing]

Reboot & at the chimes hold Cmd ⌘ R for about 10s.
Wait until you get to Recovery Mode, which for me took approx 45s from the chimes [I'm on SSD but I think it may have chosen a Recovery on another HD to actually boot from] Give it a minute or so just to be safe.

Fn Ctrl ⌃ F2 will switch focus to the menu bar, specifically the Apple logo, top left.

It appears that whatever you have set in System Prefs > Keyboard for "Use all F1, F2 keys as standard function keys" that this option is disabled in Recovery, so even though just Ctrl ⌃ F2 works for me in a running OS, in Recovery I needed the added Fn key.

From there, you can navigate using the arrow keys

Pic from https://apple.stackexchange.com/a/254167/85275

From that you can see that Terminal is 4 to the right, then 4 down.
It's 4 not 3 because the first down arrow opens the menu.

Hit Enter & Terminal will launch.
Type csrutil disable & hit Enter
Type reboot & hit Enter.

If it reboots, you got it right - otherwise you'll have to have another guess.

BTW, golden rule, as you have discovered, is keep your crappy old stock Apple card somewhere safe, for occasions such as this ;-)

Additional note: Fn Ctrl ⌃ F2 is a toggle. First will select the menu bar, second will deselect, so make sure to only do it once.

Improve this answer
4
  • Thank you for this answer! Unfortunately, while it seems to work on the iMac, every time I do this (have done it 7 times now) the MP shuts itself off. It's as though the left/right arrow keys aren't being read. I've tried with: 2 different keyboards, internet recovery, 3 different USB ports, all with the same result. Any ideas?
    – NoahL
    Nov 20, 2016 at 18:04
  • hmm, no clue, sorry. Does it work from the running OS- [at least to watch it stepping left/right as expected? TBH, I'd see if you can find an old 8800 or GT120 - every Mac Pro owner has/had one kicking around somewhere. Unfortunately they still fetch silly money for what they are, [£70 & upwards, UK] Maybe you can borrow one?
    – Tetsujin
    Nov 20, 2016 at 18:17
  • Thanks! It works fine in running OS. Just got myself an OEM 8800 GT for $60 USD (super cheap!) so I won't have this problem again
    – NoahL
    Nov 20, 2016 at 18:45
  • Excellent news. Wish you luck.
    – Tetsujin
    Nov 20, 2016 at 18:48
8

This blind method worked for me:

In order to disable or enable SIP (System Integrity Protection) without being able to see recovery mode and launch the terminal, you can use single-user recovery mode which takes you right into a command prompt.

Reboot Mac holding down CmdRS

Wait 30-60 seconds depending on how fast your boot disk is.

Then hit ENTER a few times to get to the command prompt

To DISABLE SIP: type csrutil disable; reboot and press Enter

To ENABLE SIP: type csrutil enable; reboot and press Enter

Once back in macOS you can check the status of SIP with the following command: csrutil status

Note: This will only work if the recovery OS is =>10.11 (El Cap). If you upgraded (chances are as we are talking a 2011 Mac, the recovery partition will be @ Lion or some such and will not have csrutil in it. Work around is to "recover"from a boot USB with =>10.11 on it.

Improve this answer
1
  • This does not work and errors with: failed to modify configuration. this tool needs to be executed from the Recovery OS.
    – user3439894
    Sep 7, 2020 at 23:40
5

It is possible to boot into Recovery with Single User Mode.

To do this: Hold the Option (⌥) key during initial boot to get to the Startup Manager. While holding Command (⌘)-S, select the Recovery boot volume.

This will give you Single User Recovery Mode, a terminal from which you can run csrutil disable and reboot. You are then free to continue to normal Single User Mode to disable the Extensions that use the GPU and reboot to a system with terrible graphics, but from which you can more easily recover/backup what you need before starting repairs.

Improve this answer
4

By experimentation I just discovered that it is possible to reboot holding Command-R-S and this will enter a single user recovery mode (combination of Command R for recovery and Command S for single user). This undocumented feature worked when rebooting out of recovery mode with the select disk dialogue, may or may not work with other reboot types. worked on Sierra on a 2010 macbook pro, other versions untested.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .