macOS SIP – Impact of Updates on /usr with SIP Disabled

macosmojavesip

I have a very complex application that needs a directory in /usr. By complex, I mean it would take thousands of changes to rid the code of /usr references. It has to be done, but I need a newer OS X immediately. When I attempted to upgrade an older OS X system, it wiped this directory as part of the installation. If I run the csrutil disable on the system, place the /usr subdirectory back where it goes, will ongoing OS X security updates within the Mojave version (10.14, not OS major upgrades) purge the directory when applied, or leave it in place?

Best Answer

There is no way of knowing in advance. Security and minor upgrades replace these parts of the system which Apple considers relevant/in need of fixing. While the chance that the whole /usr gets replaced is probably small it may not be very wise to rely on it.

Related Solutions

MacOS – El Capitan – Login problems with SIP enabled

VirtualBox is not compatible with El Capitan. From the VirtualBox build instructions page:

Prerequisites on Mac OS X: 10.6.x (Snow Leopard), 10.7.x (Lion), 10.8.x (Mt. Lion), 10.9.x (Mavericks) or 10.10.x (Yosemite) running on Intel hardware.

Recreate /usr/local – How to Recreate /usr/local with SIP on macOS El Capitan

/usr/local has been both re-creatable and writable on El Capitan since 2015-10-21 when Apple released /System/Library/Sandbox/Compatibility.bundle version 12 in software update 031-40358 patching 10.11 and 10.11.1, and installed as part of the 10.11.2 update, 10.11.2 combo update, and 10.11.2 clean installs. You do not need to do anything special unless you have not updated to the latest point release of El Capitan.

A patched system will have compatibility bundle greater than or equal to 12 and show

iMac-TMP:~ joe$ grep /usr/local /System/Library/Sandbox/rootless.conf 
*               /usr/local
iMac-TMP:~ joe$ grep /usr/local /System/Library/Sandbox/Compatibility.bundle/Contents/Resources/paths
/usr/local
iMac-TMP:~ joe$ defaults read /System/Library/Sandbox/Compatibility.bundle/Contents/Info.plist CFBundleVersion
12.0
iMac-TMP:~ joe$

An unpatched system will have compatibility bundle less than 12.0 and not have the /usr/local entry in /System/Library/Sandbox/Compatibility.bundle/Contents/Resources/paths.

Best Answer

Related Solutions

MacOS – El Capitan – Login problems with SIP enabled

Recreate /usr/local – How to Recreate /usr/local with SIP on macOS El Capitan

Related Question