Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

280

First: the name "rootless" is misleading, since there's still a root account, and you can still access it (the official name, "System Integrity Protection", is more accurate). What it really does is limit the power of the root account, so that even if you become root, you don't have full control over the system. Essentially, the idea is that it's too easy ...


150

Apple's documentation covers disabling SIP, About System Integrity Protection on your Mac and Configuring System Integrity Protection. An article on lifehacker.com lists these steps: Reboot your Mac into Recovery Mode by restarting your computer and holding down Command+R until the Apple logo appears on your screen. Click Utilities > Terminal. In ...


105

It's possible to disable SIP by booting to Recovery HD and running the following command: csrutil disable It is also possible to enable SIP protections and selectively disable aspects of it, by adding one or more flags to the csrutil enable command. All require being booted from Recovery in order to set them: Enable SIP and allow installation of unsigned ...


93

For me, it means DTrace no longer works. DTrace is similar to ptrace/strace in Linux, in that it allows you to see what a process is saying to the kernel. Every time a process wants to open a file, write a file, or open a port, etc, it needs to ask the kernel. In Linux, this monitoring process happens outside of the kernel in "userland", and thus ...


49

System Integrity Protection (SIP) is an overall security policy with the goal of preventing system files and processes from being modified by third parties. To achieve this, it has the following concepts: File system protection Kernel extension protection Runtime protection File system protection SIP prevents parties other than Apple from adding, deleting ...


18

You can delete this folder. This directory is a backup of shared caches (relevant to application launches) of the old system. I saved ~ 600 MB from this.


17

I know you can check whether SIP is on or off in terminal with this command: csrutil status I think you might be looking for a more detailed analysis though.


16

Disable the LaunchAgent (not LaunchDaemons) and reboot your machine (without sudo): $ launchctl unload /System/Library/LaunchAgents/com.apple.gamed.plist In case you want to enable it again at one point: $ launchctl load /System/Library/LaunchAgents/com.apple.gamed.plist


13

If the goal is to really just disable System Integrity Protection then booting into the Recovery HD partition as previously recommended in the other answers here via Command+r on boot is not the fastest way to do this. You can combine single user mode boot with recovery HD boot in an undocumented startup key combination: https://support.apple.com/en-us/...


10

/usr/local has been both re-creatable and writable on El Capitan since 2015-10-21 when Apple released /System/Library/Sandbox/Compatibility.bundle version 12 in software update 031-40358 patching 10.11 and 10.11.1, and installed as part of the 10.11.2 update, 10.11.2 combo update, and 10.11.2 clean installs. You do not need to do anything special unless you ...


10

Shutdown your laptop. Press Command + R and then the power button to boot into recovery mode. Click the Utilities menu and select Terminal. Type csrutil disable and press return. Close the Terminal app and restart out of recovery mode. Login to your machine normally and launch the Terminal app on your Mac by either searching for it in Spotlight or locating ...


9

According to this thread you can do: defaults write com.apple.gamed Disabled -bool true And to check the current state of the daemon use: defaults read com.apple.gamed Disabled


8

Edit: to answer your actual question, you can't do it from anywhere except Recovery Mode, so anything you do must be done from there. Tested on a similar 4,1 upgraded to 5,1 [but I have a flashed graphics card so I could see what I was doing] Reboot & at the chimes hold Cmd ⌘ R for about 10s. Wait until you get to Recovery Mode, which for me took ...


7

It would be safer to modify /etc/paths so that /usr/local/bin is merely before usr/bin. That way you can do your development work within /usr/local/bin without having to disable SIP. Clean installations of the OS have ordered /etc/paths this way since El Capitan, but if you were upgrading the OS from Yosemite or earlier, you'd have to modify the path order ...


7

The netboot image loaded by booting to Internet Recovery Mode apparently doesn't contain the executable csrutil. The OS X Base System loaded while booting to Recovery Mode should contain it though. By pressing cmdR a 2-step procedure is initiated: First the Mac is booted to Recovery HD and then after expanding BaseSystem.dmg to "OS X Base System" (which is ...


7

This blind method worked for me: In order to disable or enable SIP (System Integrity Protection) without being able to see recovery mode and launch the terminal, you can use single-user recovery mode which takes you right into a command prompt. Reboot Mac holding down COMMAND R S Wait 30-60 seconds depending on how fast your boot disk is. ...


6

If all you need is to access /usr/local, take a look at this page: https://github.com/Homebrew/homebrew/blob/master/share/doc/homebrew/El_Capitan_and_Homebrew.md The idea is to temporarily disable SIP using csrutil disable, add /usr/local, use chflags to set that directory to non-restricted sudo mkdir /usr/local && sudo chflags norestricted /usr/...


6

After reading @user980575's response (which is a bit redundant with directories) and a comment on Coolest Guide's On The Planet's post regarding this subject (which requires manually editing your ./configure script) I came up with an alternative solution. Overriding the EXTENSION_DIR on the fly. It took a little trial and error but when you're ready to ...


6

It seems like DYLD_* only gets stripped out for “protected” binaries (I’m not sure exactly what that means, but apparently anything in /bin and /usr/bin for starters) However, if you copy /usr/bin/env to somewhere else, it gets to keep its DYLD_* stuff: $ cp /usr/bin/env ~/Desktop; (DYLD_FOO=bar ~/Desktop/env)|grep DY dyld: warning, unknown environment ...


5

There should be no extra step required - in fact, reading through the excellent article linked from that question, I found this… Because SIP’s configuration is stored in NVRAM, SIP’s protection settings will apply to the entire machine and will persist even if the OS is reinstalled. This would perhaps imply your NVRAM is not correctly holding data - ...


5

I haven't had to deal with this "for real" yet, but I think the best solution is to: Copy the .plist file into /Library/LaunchDaemons. Rename it (e.g. by adding "local." to the beginning of the filename), and edit its Label value to match. If you don't change this, launchd is likely to get confused between this and the original. Make whatever other edits ...


5

The simplest and most secure way is to: reboot into recovery (CMD+R) start Disk Utility from the menu, select Macintosh HD and either Unlock if encrypted otherwise Mount once Macintosh HD is mounted, close Disk Utility start a Terminal from the Disk Utility menu Now run the following commands: mkdir "/Volumes/Macintosh HD/usr/local" chflags ...


5

System Integrity Protection has nothing to do with controlling what happens if the CPU breaches it thermal limit. System Integrity Protection is a security technology in OS X El Capitan and later that's designed to help prevent potentially malicious software from modifying protected files and folders on your Mac. System Integrity protection restricts the ...


4

If you disable SIP you'll get the same level of protection as you had with OS X versions before El Capitan. Whether this is enough for your needs it something only you can decide. OTOH it's not that much trouble to disable SIP briefly to chance a protected part of the system. If you want to be on the safe side, disconnect from any networks while you do this....


4

You can install a newer version of cpan in /usr/local/bin with the following CPAN configuration: cpan cpan> o conf makepl_arg "INSTALLBIN=/usr/local/bin INSTALLSCRIPT=/usr/local/bin" cpan> o conf commit cpan> exit sudo cpan -i CPAN This solution, and others, is discussed at perlmonks.


4

Instead of changing a protected file, why not change your path so that the newer SVN is called by your scripts and users? That's best practice since you don't control the OS but you control the environment. Second best would be disable SIP and overwrite the file you intend to, then re-enable SIP. The reason it's second best is it takes longer, needs you to ...


4

It is possible to boot into Recovery with Single User Mode. To do this: Hold the Option (⌥) key during initial boot to get to the Startup Manager. While holding Command (⌘)-S, select the Recovery boot volume. This will give you Single User Recovery Mode, a terminal from which you can run csrutil disable and reboot. You are then free to continue to normal ...


4

Though you shouldn't see this message (even with SIP enabled) in Recovery Mode you can type Y and continue installing rEFInd. A less rocky but time consuming way is to disable SIP in Recovery Mode by entering csrutil disable in Terminal.app. After rebooting to your main boot volume open Terminal.app, enter csrutil status and if SIP is disabled, install ...


4

From Apple's page About System Integrity Protection on your Mac Before System Integrity Protection, the root user had no permission restrictions, so it could access any system folder or app on your Mac. Software obtained root-level access when you entered your administrator name and password to install the software. That allowed the software to ...


4

The directory is SIP-protected because it is the home directory for a macports user, presumably created as part of the MacPorts installation process. The best solution is to first remove that user account, following the instructions in this accepted answer to another AppleSE question. You may also wish to remove the corresponding macports group that also ...


Only top voted, non community-wiki answers of a minimum length are eligible