SIP and macOS Sierra?

[Chromatinfish 123]

I've looked at the new macOS and it seems ok, not really worth an upgrade, but can you still disable SIP with:

csrutil disable

?

Rootless really bugs me for technical reasons and it's vital for me to disable it (well, SIP is the real name for it since root account still exists).

 

[XIII]

I did the upgrade a week ago and I'm happy with it. Is it a performance increase? Not that I can tell. Is it a performance decrease? Not that I can tell. Am I using Siri or any of the features? No. Am I on the latest version of macOS? Yup. I think this last bit is very important for all technology.

Edit: Checking now.
Edit: Yes it does.

 

[Chromatinfish 123]

Thanks- I will upgrade ASAP because of the security factor (Apple will probably not patch Yosemite any further). I definitely, however, am probably not going to be using the Siri.

 

[iangcarroll]

Yes, you can still disable SIP.

Disabling it is a fairly bad idea, because it is also a flag for allowing certain privileged calls to be made from unprivileged applications. No idea why.

If you do kernel development, you might be stuck disabling it, but try to avoid it when you can.

 

[Oh Yeah]

Yes, you can still disable SIP.

Disabling it is a fairly bad idea, because it is also a flag for allowing certain privileged calls to be made from unprivileged applications. No idea why.

If you do kernel development, you might be stuck disabling it, but try to avoid it when you can.

Hey man, thanks for jumping on the bandwagon. I mean, I know it's tough being original and all, but the "you may not want to disable SIP if you can help it" thing is a overdone even for trend-slaves, don't you think? 90% of people who say it don't even have an idea why you "may not want to". And what of the poor sysadmins running around the 10 million+ Unix/Linux machines all day without SIP to save them?

Weep for the SIP-less SysAdmins.

All hail Apple and their ceding of control of the hardware you purchased with your own money. They know what's best. After all, a million bandwagon-jumpers can't be wrong.

LOL@kernel development. Yeah, that's the only reason to disable SIP. Kernel development. ROFLMAO.

Hey, you tried, I'll give you that.

 

[StopMalware!]

i wish i had macOS Sierra

 

[XIII]

i wish i had macOS Sierra

Isn't the upgrade free for you?
macOS Sierra on the Mac App Store

 

[StopMalware!]

Isn't the upgrade free for you?
macOS Sierra on the Mac App Store

My 2014 Macbook can't download it

 

[XIII]

My 2014 Macbook can't download it

Seems odd, my early 2011 MBP downloaded it just fine.

 

[motox781]

I know this is off subject, but I had a Macbook Pro 2015 model. Used Elcapitan. Hated MacOS. Much more sugglish than Windows OS. Must be the animations. But Apple makes some of the best Windows PCs ;P Beautiful screens and well built.

Anyway, back on topic...

 

[iangcarroll]

Hey man, thanks for jumping on the bandwagon. I mean, I know it's tough being original and all, but the "you may not want to disable SIP if you can help it" thing is a overdone even for trend-slaves, don't you think? 90% of people who say it don't even have an idea why you "may not want to". And what of the poor sysadmins running around the 10 million+ Unix/Linux machines all day without SIP to save them?

Weep for the SIP-less SysAdmins.

All hail Apple and their ceding of control of the hardware you purchased with your own money. They know what's best. After all, a million bandwagon-jumpers can't be wrong.

LOL@kernel development. Yeah, that's the only reason to disable SIP. Kernel development. ROFLMAO.

Hey, you tried, I'll give you that.

I want to reply to your comment but I don't know what to reply to. You didn't really make a point. All of what SIP does can be worked around in applications. It's a valuable security mitigation against future malware which limits how malware can persist on your system, and usually forces you to persist as the current user or in the kernel, both annoying options.

It is annoying to disable, but it is practically the only way to safely provide a way to disable it. It gets messy if you provide a protected UI for it like UAC, because it's easier to social engineer.

I found out after posting this that csrutil allows selective disabling of SIP features, like file system protection. I haven't looked to see if this remedies the issue of the clock and certain system services (like SSH) being controllable from unprivileged users, but that may help the OP and others.