I wiped my SSD clean, reinstalled OS X El Capitan, removed corestoreage, and went on to remove SIP using csrutil disable in the command+R recovery environment. (I also tried it from the installation medium) It says it was successful and that I should reboot. I do that and once logged in, I type csrutil status and get back;

System Integrity Protection status: enabled (Custom Configuration)

  Apple Internal: disabled
  Kext Signing: disabled
  Filesystem Protections: disabled
  Debugging Restrictions: disabled
  Dtrace Restrictions: disabled
  NVRAM Protections: disabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

So, I reset the PRAM & SMC several times, rebooted afterwards several times, and did it again (several times) and I still get the same message. So..... is it disabled or not? :)

The one, possibly, weird thing, was that I installed an update to the recovery system via the App Store. It also wanted me to install Sierra but I'm not sure I want that yet. Did this "newer" version of the recovery make it not possible to disable it? I remember a less confusing message the last time I did it - like 2 years ago or more.

Also, I ran ls -lO /usr and it said restricted.

My mac is a :

MBP retina 15" Mid 2014

Thanks much!


By the way, I did look at this: Issue in disabling SIP (rootless) in El Capitan but running ls -lO /usr is what causes me to be concerned still....

1 Answer 1


The message you're getting confirms that you have SIP disabled as you can see that all the individual items are disabled.

The reason you're getting this sort of confusing message is that you've just re-installed El Capitan. It's the message format that was used in El Capitan 10.11.0 and 10.11.1. Apple changed this with the release of El Capitan 10.11.2 so that the message was clearer.

  • what about the 'restricted' business in the ls command? I don't remember it being that way....
    – nate
    Commented Mar 6, 2017 at 23:58
  • It's actually normal - it has to do with Apple's "Rootless" security system that was deployed on El Capitan.
    – Monomeeth
    Commented Mar 7, 2017 at 0:02
  • ok... well my install is old so maybe the 'restricted` disappeared on its own.. I'll try the newest el capitan 10.11.6 Thanks
    – nate
    Commented Mar 7, 2017 at 0:02
  • Yep, it became much more clear after updating to 10.11.6 (15G1217). 'Restricted' is still there but all seems well.
    – nate
    Commented Mar 7, 2017 at 0:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .