How to Disable SIP in macOS: Step-by-Step Guide

Introduction / Why This Is Needed

System Integrity Protection (SIP), also known as "rootless," is a core macOS security mechanism that restricts even the root user's actions. It blocks modifications to critical system files and directories (/System, /usr, /bin, /sbin, and some others).

Why disable it? SIP creates a barrier for:

• Installing third-party kernel extensions (kext).
• Deep system customization that affects protected directories.
• Some older or specialized development and administration tools.

⚠️ CRITICAL WARNING: Disable SIP only when absolutely necessary and for the minimum time possible. Disabled SIP makes your system vulnerable to malware and accidental damage. After completing the necessary operations, re-enable it immediately (instructions at the end).

Requirements / Preparation

1. Administrator password. You must know the password for an account with administrator privileges to authorize in Recovery Mode.
2. Mac with Apple Silicon (M1/M2/M3) or Intel. The procedure to enter Recovery Mode differs. This guide covers both types.
3. Full backup (Time Machine). Before disabling SIP, having an up-to-date system backup is strongly recommended. In case of unforeseen issues, this will save your data.
4. Understanding the consequences. You must clearly understand why you need to disable SIP and be prepared for potential security risks.

Step-by-Step Guide

Step 1: Booting into Recovery Mode

This is the mandatory and only way to change SIP's status.

• For Apple Silicon Macs (M1 chips and newer):
  1. Shut down your Mac (Apple menu → Shut Down).
  2. Press and hold the power button until the startup screen with the Apple logo and several options appears.
  3. Select 'Options' and click 'Continue'.
  4. When prompted, select an administrator account and enter the password.
• For Intel-based Macs:
  1. Shut down your Mac.
  2. Turn on your Mac and immediately press and hold the key combination Command (⌘) + R.
  3. Hold the keys until you see the Apple logo or a spinning globe. Release the keys.
  4. When prompted, select an administrator account and enter the password.

After successfully logging in, you will see the 'macOS Utilities' window.

Step 2: Opening Terminal

From the top menu of the 'macOS Utilities' window, go to: 'Utilities' → 'Terminal'.

A black command-line window will open, similar to a regular Terminal, but this is the recovery environment.

Step 3: Disabling SIP

In the open Terminal, type the following command exactly as written:

csrutil disable

Press Enter. If the command succeeds, you will see the message: Successfully disabled System Integrity Protection. Please restart the machine for the changes to take effect.

💡 Tip: If you want to temporarily disable SIP only for the current session (until reboot), use csrutil disable --without debug. This is a safer option for diagnostics.

Step 4: Rebooting into the Normal System

1. In the Terminal menu, select 'Terminal' → 'Exit Terminal' (or type exit).
2. In the 'macOS Utilities' menu, select 'Apple' → 'Restart'.
3. Your Mac will boot into your regular macOS system.

Step 5: Verifying SIP Status

After a full boot, open a regular Terminal (from Applications → Utilities or via Spotlight) and run:

csrutil status

Expected output for disabled SIP:

System Integrity Protection status: disabled.

If the status is enabled, the disable operation failed. Go back to Recovery Mode and repeat Step 3.

Verifying the Result

Besides the csrutil status command, you can test write permissions in protected directories. Try creating a file in a system folder, for example:

sudo touch /System/test_sip.txt

• If the command completes without errors (file created), SIP is likely disabled.
• If you see the error Operation not permitted, SIP is still active.

Important: Even with SIP disabled, some system processes may still block changes. For full access, you may also need to disable AMFI (Apple Mobile File Integrity) via csrutil enable --without amfi, but this is an extreme measure.

Possible Issues

❌ Error "Failed to modify the system integrity protection status. The operation couldn’t be completed."

• Cause: You are in the normal system, not Recovery Mode. SIP can only be modified from the recovery environment.
• Solution: Redo Step 1, ensuring you booted into Recovery Mode (the 'macOS Utilities' window should be visible).

❌ Error "Authentication failed" or the password prompt does not appear.

• Cause: Incorrect administrator password or an issue with the user account.
• Solution: Ensure you are entering the password for an account that has administrator privileges (check in 'System Settings' → 'Users & Groups'). If the issue persists, reset the password via Apple ID or recover it from Recovery Mode.

❌ System is unstable or fails to boot after disabling SIP.

• Cause: Disabling SIP itself should not cause boot failures. The problem is likely elsewhere (incompatible software, corrupted system).
• Solution:
  1. Boot into Recovery Mode again.
  2. Temporarily re-enable SIP with the command csrutil enable to restore protection.
  3. Try booting into Safe Mode (hold Shift during boot on Intel, or use startup options on Apple Silicon).
  4. Use 'Restore from Time Machine' or reinstall macOS without disabling SIP.

❌ SIP is disabled, but the needed system change still doesn't work.

• Cause: SIP is not the only protection. macOS also uses AMFI (Apple Mobile File Integrity) and codesign to verify binary integrity.
• Solution: For certain low-level operations (e.g., patching system libraries), you may need to disable AMFI: csrutil enable --without amfi (in Recovery Mode). Only do this if you are absolutely sure of your actions.

How to Re-enable SIP (IMPORTANT!)

After completing all necessary operations, you must return SIP to its original state.

1. Reboot into Recovery Mode (see Step 1).
2. Open Terminal (Utilities → Terminal).
3. Enter the command:

   csrutil enable
   

4. Press Enter. You should see the message Successfully enabled System Integrity Protection..
5. Restart your Mac normally.
6. Check the status: csrutil status. The output should be System Integrity Protection status: enabled..

© 2026 FixPedia. All rights reserved. This guide is current for macOS Catalina (10.15) and newer.