There appear to be couple of things at play regarding rootless mode:/System/Library/LaunchDaemons/com.apple.rootless.init.plist - Calls /etc/libexec/rootless-init (registers with XPC?)/System/Library/Sandbox/rootless.conf - Configures the system locations to sandbox - an asteriks or name in the first column appears to override this globally or by executable name/System/Library/Sandbox/rootless.compat - Whitelisted executables? Legacy?/System/Library/Sandbox/com.apple.xpc.launchd.rootless.plist - XPC authorizations configThe one tool that can enable and disable rootless mode right now is on the Recovery partition under /System/Library/CoreServices/Security Configuration.app. It reboots the Mac immediately after applying the configuration change (it calls shutdown -r now).This appears to write a non-removable key (as far as I've been able to determine so far) named csr-active-config which the Security Configuration tool writes to. Notable is that this also appears to affect single user mode - I was not
Topic:
App & System Services
SubTopic:
Core OS
Tags: