MacBook – SIP won’t stay disabled – I think

macbook prorecoverysip

I wiped my SSD clean, reinstalled OS X El Capitan, removed corestoreage, and went on to remove SIP using csrutil disable in the command+R recovery environment. (I also tried it from the installation medium) It says it was successful and that I should reboot. I do that and once logged in, I type csrutil status and get back;

System Integrity Protection status: enabled (Custom Configuration)

Configuration:
  Apple Internal: disabled
  Kext Signing: disabled
  Filesystem Protections: disabled
  Debugging Restrictions: disabled
  Dtrace Restrictions: disabled
  NVRAM Protections: disabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

So, I reset the PRAM & SMC several times, rebooted afterwards several times, and did it again (several times) and I still get the same message. So….. is it disabled or not? 🙂

The one, possibly, weird thing, was that I installed an update to the recovery system via the App Store. It also wanted me to install Sierra but I'm not sure I want that yet. Did this "newer" version of the recovery make it not possible to disable it? I remember a less confusing message the last time I did it – like 2 years ago or more.

Also, I ran ls -lO /usr and it said restricted.

My mac is a :

MBP retina 15" Mid 2014

Thanks much!

edit

By the way, I did look at this: Issue in disabling SIP (rootless) in El Capitan but running ls -lO /usr is what causes me to be concerned still….

Best Answer

The message you're getting confirms that you have SIP disabled as you can see that all the individual items are disabled.

The reason you're getting this sort of confusing message is that you've just re-installed El Capitan. It's the message format that was used in El Capitan 10.11.0 and 10.11.1. Apple changed this with the release of El Capitan 10.11.2 so that the message was clearer.

Related Question