I am trying to run iotop in order to see realtime disk usage stats. I disabled System Integrity Protection for dtrace by booting into Recovery Mode and running

csrutil disable
csrutil enable --without dtrace

This seems to have worked. Now back in user mode, I see the following (emphasis mine):

$> csrutil status
System Integrity Protection status: unknown (Custom Configuration).

Configuration:
	Apple Internal: disabled
	Kext Signing: enabled
	Filesystem Protections: enabled
	Debugging Restrictions: enabled
	DTrace Restrictions: **disabled**
	NVRAM Protections: enabled
	BaseSystem Verification: enabled
	Boot-arg Restrictions: enabled
	Kernel Integrity Protections: disabled
	Authenticated Root Requirement: enabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

However, running sudo iotop still results in a dtrace probe specifier error:

$> sudo iotop
dtrace: invalid probe specifier
...
...
...
: in action list: failed to resolve : Unknown variable name

What other steps need to be taken to let iotop work on an M1 mac? System details: - Monterey version 12.0.1 - Chip: Apple M1 Pro

At work my team has some scripts written for Linux which assume /mnt/foo exists, and I'd like to make them just work on my machine. But, / is a read-only file system, so I can't sudo mkdir /mnt . I can sudo echo "mnt" > /etc/synthetic.conf && sudo reboot and get a /mnt directory...but THAT is mounted as read-only and I can't create files in it. I just want /mnt/foo to redirect to /Volumes/foo (mounted via the GUI).

I have a script that copies a file from our server to the local machine. Here is the script and output + date Thu Jun 11 09:16:00 ACST 2020 + id -un root + pwd /Volumes/Macintosh HD/backups + mkdir /Volumes/Server_auto + /sbin/mount_smbfs smb://User:password@Server/General /Volumes/Server_auto + ls /Volumes Macintosh HD Server_auto + ls /Volumes/Server_auto ls: Server_auto: Operation not permitted Ultimately I want to cp -f /Volumes/Server_auto/Backups/Web/db_6_1500.zip ./db.zip but I think if I can at least get a directory listing, the copy will probably work. I can

this script from the terminal and it runs without a hitch. It has been running for several years from

without a hitch, it's only after updating to Catalina that the problems have started. I have tried - adding

,

and

to the Full Disk Access list - moving the job to a plist file in the LaunchDaemons folder Everything works just fine except for the copy operation. Behaviour is identical under

or

/launchd

. This is clearly a SIP issue. Before I added cron to the Privacy 'Full Disk Access' list, I was getting the same error message when the cron job started. Now, it's entirely blocking the external SMB share, but I don't know why or what permission to grant to make it work. The exact same sequence of operations, when run manually as

, succeed every time. Any ideas?

I have an M1 Mac Mini with three macOS systems installed within the same APFS container on the internal drive: Big Sur, Monterey, and the latest Ventura beta. If I boot into the recovery environment, open terminal and use csrutil disable to disable System Integrity Protection on my main system, the Monterey system, it works fine. However, if I try to disable SIP for either the Big Sur or Ventura systems, I get the following error: csrutil: The current recovery system is not paired with the requested volume "[volume UUID]" Ensure that the booted recovery system matches the main system that is being modified. How do I fix this?

I am using Mobile simulator and Virtual machines which are memory intensive. There are a few posts on internet about **how to change the location of Swap files on macOS versions with System Integrity Protection (SIP)**. The simplest solution without tinkering with OS internals seems to be running the below shell command after boot: sysctl vm.swapfileprefix=/Volumes/Swap/s (here /Volumes/Swap is the new swap directory) But unless SIP is disabled this command can't be executed. There should be a way to configure this on startup as I can't keep SIP disabled just to execute this command. Does setting this in */etc/sysctl.conf* work on macOS? Has anyone of you tried this? This solution is suggested in this post from 2015 for older versions of macOS when SIP didn't exist. https://apple.stackexchange.com/questions/1465/how-can-i-move-virtual-memory-swap-files-to-a-different-drive-or-partition **Open to any other alternative solutions.** Sorry for cross posting but I didn't get any constructive replies on Apple forum.

I modified Apple Mobile File Integrity by running the following commands in a Terminal:

sudo nvram boot-args="amfi_get_out_of_my_way=1"

How do I revert this change and restore the macOS defaults settings for AMFI / nvram boot-args?

On my Mac (macOS Sonoma 14.5), I have created a symlink file in the root directory (/) a long time ago. I just noticed that it must have been moved from Mac to Mac by the Migration Assistant, so that it is still there, but now protected in a way that I cannot remove it any more. I tried 1. boot to recovery mode 1. disable SIP (csrutil disable) 1. boot back into macOS Trying to remove the symlink file, this got refused because the file system is read-only. So I tried sudo mount -uw / which I had found somewhere on the web, but then got mount_apfs: volume could not be mounted: Permission denied mount: / failed with 66 In recovery mode, the symlink is not visible, so I can't do anything from there. It seems it's merged somehow into the root directory only when booting into macOS, but I don't know where it comes from then. I'm stuck there - what else can I do to get rid of the old symlink file? ----- Note that there are similar questions, but they are old and their answers don't seem to work any more on a modern sealed macOS boot volume, so I decided to ask a new question.

$ systemextensionsctl list 1 extension(s) --- com.apple.system_extension.network_extension enabled active teamID bundleID (version) name [state] * * DE8Y96K9QP com.cisco.anyconnect.macos.acsockext (4.10.04065/4.10.04065) Cisco AnyConnect Socket Filter Extension [activated enabled] Antons-MacBook-Air:MacOS agraph$ systemextensionsctl uninstall DE8Y96K9QP com.cisco.anyconnect.macos.acsockext At this time, this tool cannot be used if System Integrity Protection is enabled. This limitation will be removed in the near future. Please remember to re-enable System Integrity Protection! It seems that SIP should be glad that there is one less extension on the system? How could I get rid of the CISCO remnants I no longer need lying(running) around the mac? Not sure how it got onto the system with SIP enabled.

Is there a list of all entitlements, past and present, recognized on macOS and all other Apple operating systems? Or a list that covers at least half of them? I can't find one anywhere and the [entitlement database tool](https://newosxbook.com/ent.jl) is unusable. If there isn't one, then would I be able to find a list of all of them inside AppleMobileFileIntegrity.kext/Contents/MacOS/AppleMobileFileIntegrity?

Given that signature checks for kernel extensions and executables are both carried out in userspace, this tells me that SIP and the sandbox aren't running when launchd is still the only process running. But, I can't be sure, so I ask: is launche completely unconfined by the security features that were introduced by SIP (e.g., Sandbox, AMFI, entitlements, SIP, etc.)?

I had Mojave installed on my late 2012 Mac mini, and attempted to install Catalina on it using the internet recovery mode. This install was made to the /Volumes/Local disc, and it failed miserably not allowing me to reboot properly. I was then able to go back to a Mojave installation, and continued with a successful install from an USB drive to the /Volumes/SSDdisc, and I'm now trying to cleanup the garbage from the other install. I've read and tried various tips and tricks like adding the terminal to have _Full Disc Access_ (I've added that to /bin/rm, /bin/zsh and /usr/local/bin/bash as well), and I've run csrutil disable multiple times from Recovery mode. I've also removed the ACL entry stating: 0: group:everyone deny delete from the folders. I'm still not able to remove the folders: Applications, System, Library, Volumes and Users. I've read, and tried the tips of these posts too, but to no avail: - https://apple.stackexchange.com/a/437604/146412 - https://apple.stackexchange.com/questions/361044/cant-delete-folder-operation-not-permitted - Not sure how to remove the rootless thingy on the one folder of mine which displays this, but even if System has this, I should be able to remove the others, right? The last attempt from terminal looked like this:

my-mac-mini:~ myuser$ sudo -s /bin/zsh
root@my-mac-mini ~ # cd /Volumes/Local
root@my-mac-mini Local # ls -ledO@ Applications System Users Library Volumes
drwxrwxrwx+ 2 root  admin  sunlnk     64 Feb 25 00:10 Applications
 0: user:myuser allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity
drwxrwxrwx  2 root  wheel  sunlnk     64 Mar 12 20:51 Library
drwxrwxrwx@ 3 root  wheel  restricted 96 Mar 12 20:51 System
	com.apple.rootless	 0 
drwxrwxrwx  2 root  admin  -          64 Mar 12 20:51 Users
drwxrwxrwx  2 root  wheel  hidden     64 Mar 12 21:16 Volumes
root@my-mac-mini Local # 
root@my-mac-mini Local # csrutil status                             
System Integrity Protection status: disabled.
root@my-mac-mini Local # 
root@my-mac-mini Local # chflags nohidden Volumes
root@my-mac-mini Local # chflags -R norestricted System
root@my-mac-mini Local # chflags nosunlink Library
root@my-mac-mini Local # chflags nosunlink Applications
root@my-mac-mini Local # ls -ledO@ Applications System Users Library Volumes
drwxrwxrwx+ 2 root  admin  - 64 Feb 25 00:10 Applications
 0: user:myuser allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity
drwxrwxrwx  2 root  wheel  - 64 Mar 12 20:51 Library
drwxrwxrwx@ 3 root  wheel  - 96 Mar 12 20:51 System
        com.apple.rootless       0
drwxrwxrwx  2 root  admin  - 64 Mar 12 20:51 Users
drwxrwxrwx  2 root  wheel  - 64 Mar 12 21:16 Volumes
root@my-mac-mini Local # rm -rf Applications System Volumes Library Users Volumes
rm: Applications: Operation not permitted
rm: System/Library/PreinstalledAssetsV2: Operation not permitted
rm: System/Library/Speech: Operation not permitted
rm: System/Library/AssetsV2: Operation not permitted
rm: System/Library/Assets: Operation not permitted
rm: System/Library/Caches: Operation not permitted
rm: System/Library: Directory not empty
rm: System: Directory not empty
rm: Volumes: Operation not permitted
rm: Library: Operation not permitted
rm: Users: Operation not permitted
rm: Volumes: Operation not permitted
root@my-mac-mini Local #

--- **So now I'm running out of options, and wonder if you're able to help me remove these folders (and the sub folders from System/Library)**

After upgrading to Mojave, my rsync based backup script run via a launch agent in ~/Library/LaunchAgents, could no longer read some directories in ~/Library.

Back in the ol'days In iTunes package, there was a file called SortPrefixes.plist in localisation folders containing several sort prefixes (“The”, “A”, “An”, etc.). Removing them in this file was making iTunes to auto-sort everything including these prefixes (_The Chemical Brothers_ was listed at T and not C). (I have a _lot_ of music files and I don't want to fix this by adding a _Sort Artist_ to each of them.) In the new Music app, there is no such file in Localisation folders, but I've just found a similar one in /System/Library/PrivateFrameworks/AMPLibrary.framework/Versions/A/Resources/XX.lproj/SortPrefixes.strings, containing the same samples of prefixes. Since AMPLibraryAgent is managing libraries for Music.app and TV.app, I believe I might be on the right track and I'm tempted to clear them. But these files are stored in /System/Library/ so I don't want to mess with the system: does it sound quite safe? (It [doesn't look like](https://www.google.com/search?q=%22AMPLibrary.framework%22%20%22SortPrefixes.strings%22) a known trick yet.)

For solving a problem with a drive, I had to uninstall/unload an external SSD Samsung driver. Doing this, was reasonable easy: disable SIP in Recover (csrutil disable), rebooting, sudo kextunload /..., then rm -rf /.... Driver unloaded and gone. I backuped the driver thinking doing the opposite was that trivial, but looks it's not. I copied back the file in: /Library/Extensions, then I tried to reload the driver. I tried with sudo (sudo kextload /Library/Extensions/SamsungPortableSSDDriver.kext), disabling again SIP, even from root shell (sudo -i). Nothing seems to work. This is the error message: Filesystem error: Invalid ownership (501:0) should be (0:0) on /Library/Extensions/SamsungPortableSSDDriver.kext Any clue? Thank you.

I'm trying to disable System Integrity Protection on an M1 Mac. csrutil disable as well as csrutil authenticated-root disable fail with an error: > csrutil: Failed to update security configuration for "Macintosh HD": Failed to create local policy How can I avoid this failure? What is causing it? ---- This a brand-new Big Sur 11.0 (20A2411) on M1 MBP. FileVault is off. I'm booting into the new "Options" mode, and launching Terminal from there. Authentication is certainly OK, as I get a different error if I enter a wrong password. The user partition is accessible in this mode, I can write to /Volumes/Macintosh HD/Users/me/ for example.

-bash-3.2# csrutil disable
Turning off System Integrity Protection requires modifying system security.
Allow booting unsigned operating systems and any kernel extensions for OS "Macintosh HD"? [y/n]: y

Enter password for user admin: 
Mounted /dev/disk3s3 at 
Unmounted /dev/disk3s3 (  )
csrutil: Failed to update security configuration for "Macintosh HD": Failed to create local policy

I've recently initialized my MacBook Pro 10.2 restoring from a TimeMachine Backup. It installed macOS Catalina GM on a Beta (Not sure about that, but now I got version 19B77a (10.15.1). After this installation, there are problems installing applications or updating etc. After some investigation I've discovered that the system is unable to write the /tmp directory. I've tried to made an ls to the / directory: $ ls -lah / total 9 drwxr-xr-x 22 root admin 704B Feb 12 22:16 . drwxr-xr-x 22 root admin 704B Feb 12 22:16 .. -rw-rw-r-- 1 root admin 0B Oct 8 07:20 .DS_Store lrwxr-xr-x 1 root admin 36B Feb 12 22:14 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns ---------- 1 root admin 0B Oct 8 07:20 .file drwx------ 7 root admin 224B Apr 3 19:46 .fseventsd drwxr-xr-x 2 root wheel 64B Oct 8 07:20 .vol drwxr-xr-x+ 144 root admin 4.5K Apr 3 08:02 Applications drwxr-xr-x 64 root wheel 2.0K Mar 11 17:57 Library drwxr-xr-x@ 8 root wheel 256B Oct 15 07:37 System drwxr-xr-x 5 root admin 160B Feb 13 01:22 Users drwxr-xr-x 4 root wheel 128B Apr 3 19:50 Volumes drwxr-xr-x@ 38 root wheel 1.2K Oct 15 07:46 bin drwxr-xr-x 2 root wheel 64B Aug 24 2019 cores dr-xr-xr-x 3 root wheel 4.2K Apr 3 19:46 dev lrwxr-xr-x@ 1 root admin 11B Feb 12 22:06 etc -> private/etc lrwxr-xr-x 1 root wheel 25B Apr 3 19:50 home -> /System/Volumes/Data/home drwxr-xr-x 6 root wheel 192B Feb 13 01:22 opt drwxr-xr-x 6 root wheel 192B Feb 13 01:22 private drwxr-xr-x@ 64 root wheel 2.0K Feb 12 22:14 sbin lrwxr-xr-x@ 1 root admin 11B Feb 12 22:14 tmp -> private/tmp drwxr-xr-x@ 11 root wheel 352B Feb 12 22:14 usr lrwxr-xr-x@ 1 root admin 11B Feb 12 22:14 var -> private/var So I can see there is an incorrect group in the alias /tmp directory, but correct in /private: $ ls -lah /private/ total 0 drwxr-xr-x 6 root wheel 192B Feb 13 01:22 . drwxr-xr-x 22 root admin 704B Feb 12 22:16 .. drwxr-xr-x 126 root wheel 3.9K Mar 30 00:07 etc drwxr-xr-x@ 2 root wheel 64B Feb 13 01:22 tftpboot lrwxr-xr-x@ 1 root wheel 11B Jun 27 2018 tmp -> private/tmp drwxr-xr-x 31 root wheel 992B Feb 13 08:08 var So the next step is try to set the correct group on /tmp, but, since Catalina, the System partition is read-only: $ sudo chown root:wheel /tmp Password: chown: /tmp: Read-only file system Obliviously I've already disabled SIP: $ /usr/bin/csrutil status System Integrity Protection status: disabled. So, whats next? Got any suggestion?

At some point I made copies of all the fonts in the System>Library folder. I would now like to delete those duplicates, which are not in use and are not in a System folder. But macOS (Mojave) won't let me because the copies inherited the protections of the originals. I'm not trying to change anything that's in the System folder itself. Any suggestions? Thank you.

I've been very successfully using unison to back up my personal data to a remote machine. The problem is that I cannot seem to be using it to back up my pictures as I always get the error

Error in scanning directory:
Operation not permitted [opendir(/Users/xxxx/Pictures/Photos Library.photoslibrary)]

Clearly system integrity protection is preventing unison from accessing the photo library, either on the local machine or on the remote machine (both are Macs). I have given full disk access to pretty much everything I could imagine: Terminal.app and unison on the local machine, sshd and unison on the remote machine, but without any success. I'm now running out of things to try... Any idea?

**Currently Running:** macOS Catalina 10.15.1 **Issue:** Ever since I upgraded to Catalina, macOS is not allowing me to change read and write permissions on system protected files, hence, I am not able to tweak the system as per my likes and dislikes. **Steps Tried To Solve The Issue:** SIP, always remains [disabled on my boot drive](https://apple.stackexchange.com/questions/208478/how-do-i-disable-system-integrity-protection-sip-aka-rootless-on-macos-os-x) . So, no question arises regarding any conflict with system integrity protection. I have also tried to force change the permissions on the system files I want to edit using certain brute force commands, which I can't recall the name of, right now. But, I have tried. As of now, I am still unable to change read and write permissions on system protected files and resources.

I wanted to make a small change to a file in a protected directory, so I went into recovery mode and entered csrutil disable. Now rebooted into normal macOS csrutil status returns System Integrity Protection status: disabled.. Now when I go to make the small change, even after I changed the permissions in the info interface, the warnings are the same as before. My OS is Ventura 13.3 Beta on an M1 Mac. Is it because Apple Silicon, the beta OS or am I doing something wrong?