I am looking for further information on protecting certain files so they cannot be edited unless the system is rebooted in Recovery mode. Is SIP the direction to go in? What are the steps to make an arbitrary file restricted?


You'll need to first disable SIP temporarily by booting up in Recovery mode (or any similar means).

Then either add the extended file attribute com.apple.rootless to the file, you want to protect - or add it to /System/Library/Security/rootless.conf.

After you reboot into ordinary macOS, the file should be restricted by SIP.

  • Thank you, I have yet to try this but will accept the answer and possibly add some detail when the process is complete.
    – Henry
    Jul 5 '18 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .