Managing System Integrity Protection with csrutil (with examples)

System Integrity Protection (SIP) is a security feature introduced in macOS El Capitan that protects critical system files, directories, and processes against modifications by unauthorized applications. The csrutil command-line tool allows users to manage the configuration of SIP. In this article, we will explore eight different use cases of the csrutil command and demonstrate how to achieve specific tasks using the command.

Displaying the System Integrity Protection Status

To display the current status of System Integrity Protection, use the csrutil status command.

csrutil status

Motivation: Checking the current status of System Integrity Protection is crucial before making any changes. It allows users to verify if SIP is enabled or disabled on their macOS system.

Output Example:

System Integrity Protection status: enabled.

Disabling the System Integrity Protection

To disable System Integrity Protection, use the csrutil disable command.

csrutil disable

Motivation: Disabling SIP might be necessary in some cases, especially when working with applications that require modification of protected system files or third-party extensions that are not compatible with SIP.

Output Example:

Successfully disabled System Integrity Protection. Please restart your machine for the changes to take effect.

Enabling the System Integrity Protection

To enable System Integrity Protection, use the csrutil enable command.

csrutil enable

Motivation: Enabling SIP is highly recommended as it provides an additional layer of security to the macOS system. Once enabled, unauthorized modifications to critical system files, directories, and processes will be prevented.

Output Example:

Successfully enabled System Integrity Protection. Please restart your machine for the changes to take effect.

Displaying the List of Allowed NetBoot Sources

To view the list of allowed NetBoot sources, use the csrutil netboot list command.

csrutil netboot list

Motivation: NetBoot allows Macs to boot from a network location rather than the internal startup disk. This command is useful when verifying the list of authorized network sources available for NetBoot.

Output Example:

NetBoot sources allowed:
- 192.168.1.100
- 192.168.1.101

Adding an IPv4 Address to the List of Allowed NetBoot Sources

To add an IPv4 address to the list of allowed NetBoot sources, use the csrutil netboot add ip command. Replace ip with the desired IPv4 address.

csrutil netboot add 192.168.1.102

Motivation: Adding an IPv4 address to the list of allowed NetBoot sources allows the specified network location to be used for booting Macs. This is particularly useful in enterprise environments where multiple NetBoot sources need to be authorized.

Output Example:

Successfully added the IPv4 address: 192.168.1.102 to the list of allowed NetBoot sources.

Resetting the System Integrity Protection and Clearing the NetBoot List

To reset the System Integrity Protection status and clear the list of allowed NetBoot sources, use the csrutil clear command.

csrutil clear

Motivation: This command is useful when returning the macOS system to its default state, removing any modifications made to the SIP configuration and the list of authorized NetBoot sources.

Output Example:

Successfully reset System Integrity Protection and cleared the list of NetBoot sources.

By understanding and utilizing the different use cases of the csrutil command, we can effectively manage System Integrity Protection and ensure the security of our macOS systems.