Casper Extension Attribute script to report System Integrity Protection status

To follow up on Apple’s changing the output of csrutil status when System Integrity Protection (SIP) is disabled, I’ve posted the following Casper extension attribute to my GitHub repo to report on whether SIP is enabled or disabled.

	#!/bin/bash
	osvers_major=$(sw_vers -productVersion | awk -F. '{print $1}')
	osvers_minor=$(sw_vers -productVersion | awk -F. '{print $2}')
	# Checks to see if the OS on the Mac is 10.x.x. If it is not, the
	# following message is displayed without quotes:
	#
	# "Unknown Version Of Mac OS X"
	if [[ ${osvers_major} -ne 10 ]]; then
	echo "<result>Unknown Version of Mac OS X</result>"
	fi
	# Checks to see if the OS on the Mac is 10.11.x or higher.
	# If it is not, the following message is displayed without quotes:
	#
	# "System Integrity Protection Not Available For" followed by the version of OS X.
	if [[ ${osvers_major} -eq 10 ]] && [[ ${osvers_minor} -lt 11 ]]; then
	echo "<result>System Integrity Protection Not Available For `sw_vers -productVersion`</result>"
	fi
	if [[ ${osvers_major} -eq 10 ]] && [[ ${osvers_minor} -ge 11 ]]; then
	# Checks System Integrity Protection status on Macs
	# running 10.11.x or higher
	SIP_status=`/usr/bin/csrutil status | awk '/status/ {print $5}' | sed 's/\.$//'`
	if [ $SIP_status = "disabled" ]; then
	result=Disabled
	elif [ $SIP_status = "enabled" ]; then
	result=Active
	fi
	echo "<result>$result</result>"
	fi

view raw

gistfile1.txt

hosted with ❤ by GitHub

The script has the following functions:

If the Mac is running 10.10.x or earlier

The script reports System Integrity Protection Not Available For and then reports the relevant version of OS X. For example, the script returns the following output on a Mac running OS X 10.10.5:

System Integrity Protection Not Available For 10.10.5

If the Mac is running 10.11.x or later

This script uses csrutil status to check SIP’s status. If System Integrity Protection is disabled, the script returns the following output:

Disabled

If System Integrity Protection is enabled, the script returns the following output:

Active

For those interested, the script is available on my GitHub repo:

https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/Casper_Extension_Attributes/check_system_integrity_protection_status