Home > Mac administration, Mac OS X, System Integrity Protection > System Integrity Protection’s csrutil status’ message change for OS X 10.11.2

System Integrity Protection’s csrutil status’ message change for OS X 10.11.2

December 16, 2015 Leave a comment Go to comments

In order to check whether System Integrity Protection (SIP) is enabled or disabled on a Mac running OS X El Capitan, you can use the csrutil command to report on SIP’s current status. For example, to learn if SIP is enabled or disabled, run the following command:

csrutil status

This command can be run without root privileges and will tell you if SIP is on or off.

If SIP is enabled on 10.11.0 or higher, you should receive the following message:

System Integrity Protection: enabled

Csrutil status enabled run outside recovery

If SIP is disabled on OS X 10.11.0 or 10.11.1, you may receive a confusing message which indicates that SIP is enabled, followed by a list of individual SIP functions which are disabled. If all functions listed are showing as being disabled, SIP is actually completely disabled; it’s just confusingly worded.

Csrutil status disabled run outside recovery 10101

It appears that Apple has updated the status message on OS X 10.11.2 to make it much more clear when SIP is disabled. On 10.11.2, if SIP is disabled, you now should receive the following message:

System Integrity Protection: disabled

Csrutil status disabled run outside recovery 10102

Categories: Mac administration, Mac OS X, System Integrity Protection
  1. Alex
    December 17, 2015 at 2:58 pm
    Reply

    Wondering about an app called “XtraFinder”. Supposedly you can disable SIP, install the app so that it can inject commands into Finder, then reenable SIP without debugging. My question is, is it safe to do or would this enable other apps to inject code as well?

  2. miche bre
    December 22, 2015 at 4:52 am
    Reply

    I have been trying to disable sip completely but it won’t seem to disable.

    I don’t have a recovery partition, and have tried to disable sip by using my usb installer.
    Half of the result in terminal says disabled, and half says enabled. I have yet to get a complete disabled result.

    I would greatly appreciate any advice or tools you may have that would let me completely disable sip.

    Thanks,
    miche bre

    • Chris Giordano (@GraveSpy720)
      October 24, 2016 at 11:45 pm
      Reply

      In order to completely disable SIP, which wouldn’t really be recommended, you’ll need to disable SIP from a recovery partition. You’ll need to get a recovery partition created on your machine before you can completely disable SIP.

  1. No trackbacks yet.

Leave a comment