Could not mount root filesystem after disable SIP

I'm using intel macOS 14.5.

I'm trying to use Kernel Debug Kit, so I disabled SIP protection via csrutil disable. To locate development version of kernel in Kernel directory, I have to use the command sudo mount -uw /. However, it produces error as following:

mount_apfs: volume could not be mounted: Permission denied
mount: / failed with 66

How to solve the problem? Thank you for your attention.

Answered by DTS Engineer in 794859022

I'm trying to use Kernel Debug Kit, so I disabled SIP protection via csrutil disable. To locate development version of kernel in Kernel directory, I have to use the command sudo mount -uw /. However, it produces error as following:

Yes. In the modern boot architecture, the read-only portion of the boot volume group is actually an APFS snapshot, NOT the top level file system of the root volume. EPERM actually understates the issue here- it's not that the system rejected the request on security grounds, it's the the APFS file system implementation itself is structurally incapable of mounting a snapshot for writing.

How to solve the problem?

In general terms, you need to mount the live volume itself, copy the kernel data into the correct location, configure the root volume into a valid boot volume, create a new snapshot of that volume, then update your boot-args to point at the correct kernel variant. The full directions for this are in the "KDK_ReadMe", which is shown when you run the KDK installer.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware

I'm trying to use Kernel Debug Kit, so I disabled SIP protection via csrutil disable. To locate development version of kernel in Kernel directory, I have to use the command sudo mount -uw /. However, it produces error as following:

Yes. In the modern boot architecture, the read-only portion of the boot volume group is actually an APFS snapshot, NOT the top level file system of the root volume. EPERM actually understates the issue here- it's not that the system rejected the request on security grounds, it's the the APFS file system implementation itself is structurally incapable of mounting a snapshot for writing.

How to solve the problem?

In general terms, you need to mount the live volume itself, copy the kernel data into the correct location, configure the root volume into a valid boot volume, create a new snapshot of that volume, then update your boot-args to point at the correct kernel variant. The full directions for this are in the "KDK_ReadMe", which is shown when you run the KDK installer.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware

Could not mount root filesystem after disable SIP
 
 
Q