Enabling parts of System Integrity Protection while disabling specific parts?

Is there a way to disable certain parts of SIP while enabling parts of it? If so, then how do I do this?


I'd like to enable most of SIP (such as filesystem protections), but disable debugging restrictions so that I can attach a debugger to System Preferences to debug a preference pane, something that is normally not allowed. I'm aware of csrutil, but there's no manual for the tool, and the online help doesn't say whether it can do this or not.

Accepted Answer

Yes, you can indeed disable parts of SIP while leaving others enabled.


If you run csrutil status, even while booted normally, you will see the component parts of it. Each of these can be selectively disabled by running one of the following commands while booted into Recovery mode:


  • csrutil enable --no-internal
  • csrutil enable --without kext
  • csrutil enable --without fs
  • csrutil enable --without debug
  • csrutil enable --without dtrace
  • csrutil enable --without nvram


You can disable two or more components by structuring the command as follows:

csrutil enable --without kext --without debug


-Max

Answers

Yes, you can indeed disable parts of SIP while leaving others enabled.


If you run csrutil status, even while booted normally, you will see the component parts of it. Each of these can be selectively disabled by running one of the following commands while booted into Recovery mode:


  • csrutil enable --no-internal
  • csrutil enable --without kext
  • csrutil enable --without fs
  • csrutil enable --without debug
  • csrutil enable --without dtrace
  • csrutil enable --without nvram


You can disable two or more components by structuring the command as follows:

csrutil enable --without kext --without debug


-Max

That appeared to work, though I had to remove the \ in order to string exceptions. Thanks.


How did you come across this? This doesn't seem to be documented anywhere.

Edited accordingly.


It isn't documented yet. Hackintosh enthusiasts took the binary apart weeks ago and were able to constuct a man page of sorts.

Pls what does the without debug option do?

Lets you debug other binaries on the system.