I'm on Catalina 10.15.6.

Previously, you could write shell scripts that would set the boot volume and restart the Mac, either by using bless --mount X --setBoot or by using systemsetup -setstartupdisk, but neither of these commands seem to work now when System Integrity Protection is enabled.

There must be some way to automate this, since the System Preferences app is able to change your boot disk without SIP being disabled, you just need to provide an admin password. What mechanism does the pref pane use to set the bootup disk now? Can we invoke it in a shell script?

  • Off the top of my head, isn't the startup disk stored in nvram? Can you modify it with the nvram command? – benwiggy Aug 6 at 7:19

The designers macOS pick which commands that are constrained by SIP. To be more precise, certain commands are given the ability to bypass the constrains of SIP. The bless command is not one of the commands that is contained by SIP. To use the command to set the default to boot would require disabling at least part of SIP.

An alternative would be to use a boot manager which can be configured from a macOS script or application. An example of such a boot manager is rEFInd. If installed in a EFI partition, then a password would be required to first mount the partition. If installed to a FAT of ExFAT partition then no password would be required, but would be less secure. The default_selection token can be use to choose the default operating system to boot. Typically, this token and parameters are stored in a file of your choosing. The name of this file is then given as the parameter to the include token stored in the refind.conf file.

| improve this answer | |
  • Yes, bless does not work without disabling SIP. But the System Preferences app is able to change the boot disk without disabling SIP. How does the System Preferences app do it? As far as I know, everything that app does can be scripted somehow (for example, many settings can be changed with /usr/bin/defaults and you can do system updates with /usr/sbin/softwareupdate) – Karew Aug 11 at 20:20
  • When building a application or command with Xcode the proper credentials have to exist in the project to enable the executable to bypass the restrictions presented by SIP. This is not done for bless. For commands that can bypass SIP, Apple may publish the project and source code, but not the files containing the credentials. For example, you can build the fsck_hfs executable by downloading the source. However, your executable will not be able to bypass SIP, where as the one provided by macOS 10.15 can. – David Anderson Aug 12 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .