SIP Disabled From Factory

Question

SIP Disabled From Factory

Just a warning for people getting their 2016 MacBook Pro. I was alerted to the issue after reading this article..

http://www.macrumors.com/2016/11/17/system-integrity-protection-disabled-macbook -pro/

Sure enough, my 2016 15" MacBook had SIP disabled. This is a key feature of security on our Macs, and for it to come from the factory this way is inexcusable!!

The simple fix is to enable SIP from Terminal while in booted into Recovery mode.

Posted on Nov 23, 2016 1:09 PM

Reply

Answer 1

Eric Root

Level 10

684,045 points

Nov 23, 2016 2:12 PM in response to John Paterson1

Would you mind posting the required Terminal command for people that don't know it?

Reply

Answer 2

Nov 23, 2016 2:31 PM in response to Eric Root

This article explains it nicely...

http://osxdaily.com/2015/10/05/disable-rootless-system-integrity-protection-mac- os-x/

Reply

Answer 3

Nov 23, 2016 2:46 PM in response to John Paterson1

Just checked mine (15" Late 2016). It is ENABLED. Maybe a glitch on some Macs the went out. But I am glad I checked after reading this.

Reply

Answer 4

Nov 23, 2016 5:39 PM in response to georg2011

The article I read with the warning, did say it is not a universal screw-up. But new owners should do the simple Terminal command to verify whether or not their's is off.

Reply

Answer 5

Kappy

Level 10

361,741 points

Nov 23, 2016 7:21 PM in response to Eric Root

Turning Off Rootless System Integrity Protection in OS X El Capitan 10.11.x or Later

Again, the vast majority of Mac users should not disable rootless. Disabling rootless is aimed exclusively at advanced Mac users. Do so at your own risk, this is not specifically recommended.

Reboot the Mac and hold down Command + R keys after the startup chime, this will boot OS X into Recovery HD
When the Utility Menu appears, select the Terminal from the Utilities menu in the menubar.
Paste the following command into the terminal then hit return: csrutil disable; reboot
You’ll see a message saying that System Integrity Protection has been disabled, and the Mac needs to restart for changes to take effect. The Mac will then reboot itself automatically.
You can also issue the command by itself without the automatic reboot like so: csrutil disable

Once the Mac boots up again, System Integrity Protection will be disabled entirely in OS X.

Checking the Status of Rootless / System Integrity Protection in OS X

If you want to know the status of rootless before rebooting or without rebooting the Mac from the Recovery HD, just paste the following command into the Terminal: csrutil status

You’ll either see one of two messages:

$ csrutil status

$ System Integrity Protection status: enabled.

or

$ csrutil status

$ System Integrity Protection status: disabled

If at any time you want to change the status of rootless, another reboot from the Recovery HD is required.

How to Re-Enable Rootless System Integrity Protection in OS X

Simply reboot the Mac again from the Recovery HD as directed above, but at the command line use the following syntax instead: csrutil enable

Just as before, a reboot of the Mac is required for changes to take effect.

Reply