System Integrity ProtectionQuestion:Will disabling SIP be available as a choices .XML at install time for the 10.11 OS? If not, what mechanism will be provided for automatic disabling of SIP for use with automated imaging processes for machines?Pain point: Not every environment will be able to access Internet Recovery. At the same time, straight cloning of existing disks is problematic.Answer:SIP is always off in the Recovery environment and the Installer environment. While booted from those environments, you will be able to make changes to a boot disk which is otherwise protected by SIP.SIP-protected files will still appear as restricted when listed with ls's -O, but they can be renamed, moved, deleted or changed.There will be a command line tool to disable SIP in the Recovery environment, separate from the current GUI tool. The GUI tool is in fact going to disappear in favor of the command line tool. This change will likely appear in Developer Beta 2 or Beta 3; check the release notes.Question:The /System/L