MacOS – How to reenable System Integrity Protection

macossip

How do I reenable System Integrity Protection, after using csrutil disable from the Recovery OS?

Best Answer

The opposite of disable is enable, so: csrutil enable

At the present time there is no manual page for csrutil i.e. man csrutil doesn't provide any help, however executing the command without an argument displays its internal help as shown below.

$ csrutil
usage: csrutil <command>
Modify the System Integrity Protection configuration. All configuration changes apply to the entire machine.
Available commands:

    clear
        Clear the existing configuration. Only available in Recovery OS.
    disable
        Disable the protection on the machine. Only available in Recovery OS.
    enable
        Enable the protection on the machine. Only available in Recovery OS.
    status
        Display the current configuration.

    netboot
        add <address>
            Insert a new IPv4 address in the list of allowed NetBoot sources.
        list
            Print the list of allowed NetBoot sources.
        remove <address>
            Remove an IPv4 address from the list of allowed NetBoot sources.
$

Related Solutions

MacOS – How to disable System Integrity Protection (SIP) AKA “rootless” on macOs [OS X]

Apple's documentation covers disabling SIP, About System Integrity Protection on your Mac and Configuring System Integrity Protection.

An article on lifehacker.com lists these steps:

Reboot your Mac into Recovery Mode by restarting your computer and holding down Command+R until the Apple logo appears on your screen.

Click Utilities > Terminal.

In the Terminal window, type in csrutil disable and press Enter.

Restart your Mac.

You can verify whether a file or folder is restricted by issuing this ls command using the capital O (and not zero 0) to modify the long listing flag:

ls -lO /System /usr

Look for the restricted text to indicate where SIP is enforced.

By default (=SIP enabled), the following folders are restricted (see Apple Support page):

/System
/usr
/bin
/sbin
Apps that are pre-installed with OS X

... and the following folders are free:

/Applications
/Library
/usr/local

MacOS – Disable System Integrity Protection on OS X running on VMware

I know this is an older question but I came across it looking for a solution to this problem so I figured I would submit an answer that contains all of the info I came across in one place.

Background

My environment

Host

Windows 10
VMWare Workstation 12 (patched to run macOS)

Guest

macOS High Sierra 10.13.4

I originally tried adding macosguest.forceRecoveryModeInstall = "TRUE" to my .vmx config. This allowed me to boot into recovery and could disable SIP but then I couldn't get the VM to boot normally, even after removing that line.

The solution to this problem I found was to just delete the .nvram file. Unfortunately, that's where the flag to disable SIP is stored so when my VM came back up SIP was enabled again.

My Solution

From the Terminal, run the following commands (thanks to G5tube for this suggestion)
```
 sudo nvram "recovery-boot-mode=unused"
 sudo reboot recovery
```
The second command will reboot your Mac instantly, so better save any unfinished work first.
Once the Mac has rebooted into the Recovery / Installer system (you may have to choose your language first): From the menu bar, click Utilities > Terminal
Run csrutil disable from the terminal, followed by reboot
Once your VM has rebooted normally you can verify that SIP was disabled by opening a terminal and running csrutil status

To turn SIP back on, follow the same steps as above but run csrutil enable at the recovery terminal instead.