Is there a way to add folders to the SIP (System Integrity Protection) configurations in order to prevent them to be modified by the root user? Or any other way not involving System Integrity Protection?
I want to protect the host file so I can block distracting websites and not being able to modify it as a root user. As a developer, I still need to be a root user so deleting sudo is not an option.

I'm looking for a solution which is independent from my internet connection.

  • 2
    The root user has by design access to all files on the system. I don''t think you can extend SIP to protect user-defined folders or files. You could however, as explained here: support.apple.com/HT204012, disable the root user. The other option would be to place those files on a read-only partition (but then they wouldn't be writeable for anyone...). I'd be helpful if you explained why you think that root access to some files (which files?) is a problem.
    – jaume
    Commented Jul 28, 2020 at 10:51
  • I want to be unable to modify the host file. I use this file to block distracting websites but it's too easy comment some lines: sudo vim /etc/hosts. If I'd need to reboot and disable SIP it would make things harder and thus make me avoid to modify the host file
    – Hugh
    Commented Jul 29, 2020 at 7:06
  • Why don't you delete the sudo command? If you need to modify /etc/hosts, you will need to boot in single user mode (support.apple.com/HT201573), remount the root file system in read/write mode and only then will you be able to make changes to /etc/hosts. The downside is that you won't be able to execute commands as root with Terminal.
    – jaume
    Commented Jul 29, 2020 at 8:47
  • As a developper, deleting the sudo command is unfortunately not a solution. That's why I was thinking about something involving SIP, since it seems to be the only thing that restricts root access to files.
    – Hugh
    Commented Jul 29, 2020 at 11:10
  • Disabling the root user won't accomplish anything, sudo will still work.
    – nohillside
    Commented Jul 29, 2020 at 11:48

1 Answer 1



SelfControl is an open source project aimed at restricting distractions:

SelfControl is a free and open-source application for macOS that lets you block your own access to distracting websites, your mail servers, or anything else on the Internet. Just set a period of time to block for, add sites to your blacklist, and click "Start." Until that timer expires, you will be unable to access those sites—even if you restart your computer or delete the application.


To block distracting websites and services on all your devices, consider blocking them on your network using Pi-Hole.

With this approach you avoid needing to modify your macOS configuration.

  • As I don't have a fixed place where I live and I'm often using tethering, this won't work for me.
    – Hugh
    Commented Jul 29, 2020 at 14:00
  • I have added a local option, SelfControl. Commented Jul 29, 2020 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .