System Integrity Protection

<p>System Integrity Protection (SIP, sometimes referred to as rootless) is a security feature of <a href="/facts/Apple_Inc./oTJYta3k">Apple</a>'s <a href="/facts/MacOS/Y93vVpTm">macOS</a> <a href="/facts/Operating_system/8XTuvMh2">operating system</a> introduced in <a href="/facts/OS_X_El_Capitan/4NAIbG7c">OS X El Capitan</a> (2015) (OS X 10.11). It comprises a number of mechanisms that are enforced by the <a href="/facts/Kernel_(operating_system)/uEj4U3Rz">kernel</a>. A centerpiece is the protection of system-owned <a href="/facts/System_file/dtxxmAAL">files</a> and <a href="/facts/System_folder/GPBr9579">directories</a> against modifications by processes without a specific "entitlement", even when executed by the <a href="/facts/Root_user/0Brr6ol7">root user</a> or a user with <a href="/facts/Root_privileges/0Brr6ol7">root privileges</a> (<a href="/facts/Sudo/7jhmGdqg">sudo</a>). 
</p><p>Apple says that the root user can be a significant risk to the system's security, especially on a system with a single <a href="/facts/User_(computing)/zQRzG0KG">user account</a> on which that user is also the administrator. SIP is enabled by default but can be disabled.
</p>

System Integrity Protection open-in-new

System Integrity Protection