In El Capitan, Apple introduced System Integrity Protect (SIP, sometimes also known as rootless), a security feature that’s designed to help protect your Mac against malicious code.
Prior to El Capitan, gaining access to your Mac’s most important system files simply required the admin password, which meant that anyone with access to this password could potentially modify or even delete your Mac’s most important files.
SIP’s approach to keeping your Mac safe, is to prevent anyone from accessing sensitive areas of the macOS file system – including you.
While it’s unlikely that you’ll feel the effects of this restriction when you’re performing day-to-day tasks, if you’re someone who enjoys customizing their Mac, or who occasionally uses system-modifying apps and utilities, then you might find that SIP occasionally gets in the way of what you’re trying to achieve. For example, you can’t change your system font while SIP is enabled, and you can’t work outside of your home directory, even if you’re using Sudo at the command line. You may even find that a system-modifying app you’ve been using for years without any issues suddenly stops working as soon as you upgrade to a new version of macOS.
In this article, I’m going to show you exactly how to disable SIP, but first, a disclaimer:
Why you should never leave SIP switched off
Even though this article is all about disabling SIP, it’s important to note that your Mac will be at an increased risk of contracting malware and viruses for the entire time SIP is disabled, and even though macOS has a reputation for being pretty malware-resistant, Mac viruses and malicious code aren’t unheard of.
If you do choose to disable SIP, then to help keep your computer safe you should complete the task that prompted you to disable SIP straight away, so you can re-enable it as soon as possible.
Even if SIP is causing problems with one of your favourite applications, then you should resist the temptation to leave SIP turned off. Instead, double-check that you’re running the latest version of the app in question, because if you have an older version installed then it’s possible that this problem may have already been resolved in a subsequent update. And if you do have the latest version, then you should consider reaching out to the application’s developer, as they may be unaware of the issue, or may even know a workaround that’ll allow you to use their application normally while SIP is still enabled.
How to Turn off System Integrity Protection
To disable SIP:
- Turn your Mac off.
- Boot into recovery mode, by restarting your Mac while holding down the ‘Command’ and ‘R’ keys. Release these keys as soon as you see the Apple logo and ‘loading’ bar.
- Once your Mac is in recovery mode, select ‘Utilities’ from the menu bar, followed by ‘Terminal.’
- In the Terminal window, enter the following command:
csrutil disable
- Press the ‘Enter’ key on your keyboard.
- Close the Terminal window.
- Restart your Mac, as normal.
Once you’ve restarted your Mac, you can check whether SIP is truly disabled, by opening your Mac’s Terminal (‘Applications > Utilities > Terminal’).
- Enter the following command into the Terminal:
csrutil status
If SIP is disabled, then it’ll return a “System Integrity Protection status: disabled” message.
While SIP is disabled, your Mac is more vulnerable to malicious code and hackers, so you should make a point of performing whatever task(s) SIP was interfering with, and then re-enabling it as soon as possible.
Re-enable System Integrity Protection
- Boot into Recovery mode by holding the ‘Command+R’ keys while restarting your Mac.
- Once in recovery mode, select ‘Utilities > Terminal.’
- In the Terminal window, enter the following:
csrutil enable
- Hit the ‘Enter’ key.
- Exit the Terminal and restart your Mac, as normal.
SIP is now enabled and you once again have that extra layer of protection against people and programs that might be trying to damage your Mac.
If you want to double-check that SIP is up and running, then open a Terminal window and enter the csrutil status command. This time it should return: “System Integrity Protection status: enabled.”