Security configuration is stored in NVRAM rather than in the file system itself. As a result, this configuration applies to all installations of macOS across the entire machine and persists across macOS installations that support System Integrity Protection.

Note: To safeguard against disabling System Integrity Protection by modifying security configuration from another OS, the startup disk can no longer be set programmatically, such as by invoking the bless(8) command.

System Integrity Protection can be configured using the csrutil(1) command.

You can check whether System Integrity Protection is currently enabled on your system by running the following command in the Terminal:

To enable or disable System Integrity Protection, you must boot to Recovery OS and run the csrutil(1) command from the Terminal.

Boot to Recovery OS by restarting your machine and holding down the Command and R keys at startup.

Launch Terminal from the Utilities menu.

Enter the following command:

$ csrutil enable

After enabling or disabling System Integrity Protection on a machine, a reboot is required.

Note: For certain enterprise configurations that do not allow booting to Recovery OS, System Integrity Protection can be configured by other means. See “Prepare for NetBoot, NetInstall, and NetRestore requirements in OS X El Capitan” for more information.

Copyright © 2015 Apple Inc. All Rights Reserved. Terms of Use | Privacy Policy | Updated: 2015-09-16