macOS - What is SIP?
Posted: Aug 5, 2021 | ~ 1 min read time#macOS #forensics #howto
SIP (system integrity protection) is used on macOS to prevent unsigned or unknown code from executing freely. For troubleshooting or testing purposes, you can disable SIP altogether by booting into recovery mode. Of course, once you’re done testing, it’s a best practice to turn SIP back on.
- Boot into Recovery Mode
- Press and hold
CMD + R
when booting up the machine until the Apple logo appears. - If you’re on a VM, it may be easier to run the following commands in the Terminal
sudo nvram "recovery-boot-mode=unused" sudo reboot recovery
- Press and hold
- Once the machine has started, you’ll see the Recovery/Installer page. From the top menu bar, click
Utilities > Terminal
- Run the commands
csrutil disable reboot
- To verify if SIP is enabled/disabled run the command
csrutil status
Note: To turn SIP back on, follow the above steps but run csrutil enable
instead.