`csrutil disable` command FAILED. The OS environment does not allow changing security configuration options.

Same issue as you on my MacOS Monterey 12.0.1, Mackbook Pro 2021 with M1 Pro. I finally figured out the solutions as follows:

**Solution 1**

Use the Security Policy in the Startup Security Utility under the Utilities menu instead of Terminal, to downgrade the SIP level. (refer to https://support.apple.com/guide/mac-help/macos-recovery-a-mac-apple-silicon-mchl82829c17/mac)

**Solution 2**

Run "csrutil clear" to clear the configuration, then "reboot". Now do the "csrutil disable" command in the Terminal.

Assuming you have entered the Recovery mode already, by holding down the Power button when powering-up/rebooting.

If you want to delete some files under the /Data volume (e.g. the notorious "/Users/Shared/Previously Relocated Items" garbage, forgot to purge before upgrading to Catalina), do "sudo mount -uw /System/Volumes/Data/" first (run in the Terminal after normal booting).

Don't forgot to enable the SIP after you have finished the job, either through the Startup Security Utility or the command "csrutil enable" in the Terminal.

BTW, I'd appreciate if someone can help to remove some files under /usr because "mount -uw" doesn't work on the "/" root directory. On my old macbook, I created a symbolic link named "X11" under /usr to run XQuartz and forgot to remove the link with it later. Unfortunately this link file became a core part of the MacOS system protected by SIP after upgrading to Big Sur...

Hi agou-ops,

As mentioned by HW-Tech, Apple has added additional security restrictions for disabling System Integrity Protection (SIP) on Macs with Apple silicon. This is because the SIP configuration is stored directly in the Security Policy (aka the LocalPolicy).

To downgrade the security policy:

• You must shut down or power off your Mac, then press and hold the power button (Touch ID) to load Startup Options. Holding down the power button proves that a human, not malicious software, is requesting a downgraded security policy. If you landed in macOS Recovery without holding down the power button, you won't be able to downgrade the security policy until you shut down or restart.

• In macOS Monterey or future, you must start up from the copy of macOS Recovery that is paired to your startup disk. This should only be an issue if you have multiple copies of macOS installed. To fix this issue, start up in macOS Recovery, click the Apple logo, select Startup Disk, select your startup disk (likely Macintosh HD), and restart. Then try starting up in macOS Recovery again.

If you still cannot disable System Integrity Protection after completing the above, please let me know.

Great to hear! It is technically possible to get into what Apple calls "1 True Recovery (1TR)" via a reboot, but you have to hold down the power button (Touch ID) as soon as the display backlight turns off. It's much easier to boot to 1TR from a shutdown state.

Also, you might want to read these documents if you're interested. They have more details on how the Secure Boot architecture works:

• The bputil man page (in macOS, open Terminal, and search for bputil under the Help menu).

• Apple's Platform Security document (the hardware and system sections are especially relevant).

celleo wrote:

Same issue as you on my MacOS Monterey 12.0.1, Mackbook Pro 2021 with M1 Pro. I finally figured out the solutions as follows:

**Solution 1**

Use the Security Policy in the Startup Security Utility under the Utilities menu instead of Terminal, to downgrade the SIP level. (refer to https://support.apple.com/guide/mac-help/macos-recovery-a-mac-apple-silicon-mchl82829c17/mac)

System Integrity Protection (SIP) and the Security Policy (LocalPolicy) are not the same thing. On Macs with Apple silicon SoCs, the SIP configuration is stored inside the LocalPolicy file - SIP is a subset of the security policy. That said, you won't be able to change SIP settings in Startup Security Utility, because the Permissive Security option isn't available in Startup Security Utility. See the security levels below for more info:

Full Security: The default option, with no security downgrades permitted. Available in Startup Security Utility.

Reduced Security: Any compatible and signed version of macOS is permitted. SIP is locked as fully enabled. These options are also available:

• Allow notarized kernel extensions
• Allow MDM to manage kernel extensions and software updates

Permissive Security: All of the options permitted by Reduced Security are also permitted here. In addition, you can boot a custom kernel (the Asahi Linux team is using this to allow booting Linux in the future). These options are also available:

• Modify the SIP configuration
• Disable Kernel Integrity Protection (disable CTRR)
• Disable Signed System Volume verification
• Allow all boot arguments (including Single User Mode)

To modify or disable SIP, use the csrutil command-line tool. Customizing or disabling SIP will automatically downgrade the security policy to Permissive Security.

celleo wrote:

BTW, I'd appreciate if someone can help to remove some files under /usr because "mount -uw" doesn't work on the "/" root directory. On my old macbook, I created a symbolic link named "X11" under /usr to run XQuartz and forgot to remove the link with it later. Unfortunately this link file became a core part of the MacOS system protected by SIP after upgrading to Big Sur...

In macOS Big Sur and later, your Mac boots from a cryptographically sealed snapshot. The seal is verified against the value provided by Apple at every boot. Because of this, the symlink in the usr folder must reside on the Data volume, and thus be located at: /System/Volumes/Data/usr

There are certain parts on the Data volume that are protected by SIP, such as Safari. To remove the symlink, try disabling SIP temporarily (which is most likely protecting the symlink on the Data volume).

Apple has been tightening security within macOS for years now. It sounds like Apple may be going even further with Monterey. I don't have a Monterey system to test.