Configuring SIP on macOS: Disabling, Enabling, and Management

Introduction

System Integrity Protection (SIP), also known as "rootless," is a core security feature in macOS starting with OS X El Capitan. It restricts the actions of the superuser (root) to protect critical system files and processes from modification. While SIP enhances security, in some cases—such as installing specific software or performing deep system customization—it may need to be disabled or configured. This guide explains in detail how to safely manage SIP on your Mac.

Prerequisites

Before you begin, ensure that:

• You have a Mac with macOS 10.11 (El Capitan) or newer (the instructions apply to all versions, including Catalina, Big Sur, Monterey, Ventura, and newer).
• You are logged in with an administrator account.
• You have access to Terminal and understand basic commands.
• Creating a backup of your data via Time Machine or another method is strongly recommended, as modifying SIP can affect system stability.
• You understand the risks: disabling SIP makes your system vulnerable to malware and accidental changes.

What is SIP and How It Works

SIP protects the following areas:

• System directories such as /System, /usr (except /usr/local), /bin, /sbin.
• Processes related to the kernel and system services.
• NVRAM variables related to booting.

When SIP is enabled, even the root user cannot modify these protected resources. This prevents attacks that attempt to modify system files to gain persistent access. SIP also restricts kernel debugging and other potentially dangerous operations.

Checking the Current SIP Status

Before making any changes, check whether SIP is enabled:

1. Open Terminal (via Spotlight or Finder → Applications → Utilities).
2. Enter the command:

   csrutil status
   

3. The output will indicate System Integrity Protection status: enabled. or disabled..

If SIP is disabled, you will see the corresponding message. This step is important to avoid unnecessary actions.

Disabling SIP

If you need to disable SIP completely, follow these steps:

Step 1: Reboot into Recovery Mode

1. Shut down your Mac.
2. Turn on your Mac and immediately hold the Command + R keys on the keyboard.
3. Hold the keys until the Apple logo or a spinning loading indicator appears. This may take a few seconds.
4. For Mac with Apple Silicon (M1/M2): Shut down the Mac, press and hold the power button until startup options appear, select "Options," and click "Continue" to enter Recovery Mode.

Step 2: Disable SIP via Recovery Mode Terminal

1. In Recovery Mode, open Terminal from the "Utilities" menu in the top menu bar.
2. Enter the command:

   csrutil disable
   

3. Press Enter. You should see the message Successfully disabled System Integrity Protection..

Step 3: Reboot the System

1. In Terminal, type:

   reboot
   

   or select "Restart" from the Apple menu.
2. After reboot, your Mac will start into the normal system.

Step 4: Verify Disabling

1. After logging in, open Terminal.
2. Run csrutil status again.
3. The output should show System Integrity Protection status: disabled..

Enabling SIP

If you previously disabled SIP and want to re-enable it for security:

Step 1: Reboot into Recovery Mode

As described above, reboot your Mac into Recovery Mode (Command + R or via the power button on Apple Silicon).

Step 2: Enable SIP

1. In the Recovery Mode Terminal, enter:

   csrutil enable
   

2. Press Enter. You will see a success message.

Step 3: Reboot and Verify

Reboot your Mac and check the status as in the previous section. The output should be enabled.

Partial SIP Configuration (Advanced Users)

Starting with macOS Catalina (10.15), csrutil supports flags for fine-grained control over SIP components. This allows disabling only specific restrictions while keeping others active.

Available options (check csrutil help in Recovery Mode for the current list):

• --without fs — disables filesystem protection.
• --without debug — allows kernel debugging.
• --without nvram — allows modification of NVRAM variables.
• --without dtrace — disables DTrace restrictions.
• --without amfi — disables code signing validation (AMFI).

Example: Disabling Only Filesystem Protection

1. Reboot into Recovery Mode.
2. In Terminal:

   csrutil enable --without fs
   

3. Reboot your Mac.
4. Check the status: csrutil status will show enabled, but filesystem protection will be disabled. You will be able to modify files in protected directories, but other SIP components will remain active.

⚠️ Important: Partial SIP configuration can lead to unexpected security issues. Use it only if you are certain of what you are doing and only for specific tasks. After completing your work, it is recommended to restore full protection with csrutil enable.

Verifying the Result

After changing SIP, ensure the changes took effect:

1. Open Terminal in your normal system.
2. Run csrutil status.
3. For full disable: System Integrity Protection status: disabled.
4. For enable: System Integrity Protection status: enabled.
5. For partial configuration, the output may be enabled but with indications of disabled components. Use csrutil status for details or test if you can perform the actions for which you disabled protection.

Additionally, try modifying a protected file, such as /System/Library/CoreServices/SystemVersion.plist (create a backup first!). If SIP is disabled, the change should succeed; if enabled, you will get a permission error.

Possible Issues

Error: "csrutil: command not found"

This error occurs if you try to run csrutil in the normal system instead of Recovery Mode. Solution: Reboot into Recovery Mode and run the command there.

SIP Does Not Disable After csrutil disable

Ensure you are in Recovery Mode and entered the command correctly. After reboot, check the status. If it is still enabled, you might be using an Apple Silicon Mac and did not enter Recovery Mode correctly. For Apple Silicon: shut down the Mac, press and hold the power button until startup options appear, select "Options," then "Continue" to enter Recovery Mode.

System Becomes Unstable After Disabling SIP

Disabling SIP can allow corruption of system files. Solution: Re-enable SIP as described above. If the system does not boot, try going into Recovery Mode, enabling SIP, and then rebooting.

Cannot Modify a Specific File Even After Disabling SIP

Some files may be protected by other mechanisms, such as file permissions (chmod) or other SIP components. Check if SIP is fully disabled. Also, ensure you are using sudo for administrative privileges.

Partial Configuration Does Not Work as Expected

csrutil flags may be incompatible between macOS versions. Ensure you are using the correct syntax for your version. Check csrutil help in Recovery Mode for the list of options. Some features may require additional steps, such as modifying NVRAM variables.