I was looking to lock down the configuration on some macs, and wanted to know if there is any way to change the files and folders that SIP protects. I know it can be disabled, and its current rules viewed, but is there any way to add your own protected directories?



It is possible to add your own protected directory to SIP:

  • Boot to Recovery Mode and disable SIP
  • Reboot and create a directory structure.
  • Flag the whole folder or single files or folders:

    sudo chflags restricted /example
    sudo chflags restricted /example/example.app
    sudo chflags restricted /example/subdir/file

    or a folder hierarchy:

    sudo chflags -R restricted /example

    If you want to exclude a subdir after using the -R option you have to remove the restricted flag there:

    sudo chflags norestricted /example/subdir
  • Boot to Recovery Mode and enable SIP

Now the folders example, example.app and the file /example/subdir/file are protected. You still can add or remove files to/from /example/subdir.

The restricted flag has no effect if SIP is disabled - the usual POSIX/ACLs permissions apply. With SIP enabled the files/folders are protected.

It is also possible to add, remove or change SIP-protected files and directories via an installer package which is signed by Apple’s own certificate authority. Since a normal user /customer usually doesn't have access to this certificate authority, this possibility is eliminated.

An earlier version of this answer asserted that it is required to modify the file /System/Library/Sandbox/rootless.conf and add something like:

*                               /example/subdir

This is wrong! Simply flagging a file or folder as restricted is sufficient to protect it.

  • 1
    Please clarify: Why is it "wrong", is it unnecessary, doesn't work, overreaching, bad practice… – LаngLаngС Mar 2 '19 at 11:14

As far as I know, there is no way to modify which directories SIP protects; SIP is either on or off. Apple appears to make no mention to such an ability in their developer documents either.

Disregard this, @kanomath has a better answer. The latter part of my answer still stands to a limited degree.

If you want to lock down configuration files, modify the filesystem permissions either through the Finder GUI or the command line utility chown.

  • Fair enough, edited to refer to your answer. – JMY1000 Feb 7 '17 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .