Hello Andreaux,I thought I am missing something that should be displayed... By the way, what happens when I press Command-R at boot and there is 2 Recovery OS partitions? I thought that at least one should boot, but neither 10.7.5, nor 10.11.4 recovery partitions boot
You might want to give my RRHD a try see post #1607
[doublepost=1462808156][/doublepost]
Hi there,
How can I tell if SIP is really disabled? I am unfortunately unable to boot into the Recovery partition (I don't know why), but I tried booting the installer disk and issued the csrutil disable command...
Now if I boot normally and issue a csrutil status command, I get this:
bash-3.2# csrutil status
System Integrity Protection status: enabled (Custom Configuration).
Configuration:
Apple Internal: disabled
Kext Signing: disabled
Filesystem Protections: disabled
Debugging Restrictions: disabled
DTrace Restrictions: disabled
NVRAM Protections: disabled
This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.
Is this how it's supposed to look like?
Any advice welcome.
Cheers,
Andreaux
That's weird!
It says "enabled" and then lists everything as disabled!
What version of the OS were you booted into when you ran that command?
You typically have to be booted from the recovery partition (of 10.11.x) to make changes to the SIP configuration. This is because the kernel (SIP) protects both system files and the NVRAM. SIP's configuration is held in NVRAM, therefore to make changes you need a recovery partition (or strictly speaking something that will allow you to change the NVRAM).
I know Pike had some early versions of the boot.efi files for 10.11 that might cause the SIP configuration to behave as you have reported. Do you have the "latest" boot.efi files installed on El Capitan?
[doublepost=1462808465][/doublepost]
I think CaptainPike works in a similar way to Boot64 so may be causing the "custom" status. My understanding is that SIP is disabled on the boot.efi files so they can be replaced automatically if / when the OS update tries to change them. There are ways to be able to boot into recovery - look for posts by rthpjm - but as others have noted, it doesn't matter that much as you probably have an earlier OS you can boot into to make any changes to things such as boot.efi files.
For clarity. BOOT64 relies on some modifications to the SIP compatibility bundle (strictly speaking the Sandbox extension compatibility bundle), and yes it does try to maintain those changes too for when Apple updates the files.
Neither BOOT64 nor capitanpikefix interact with csrutil. This has to be done when running a kernel that allows modification of the NVRAM (e.g. the one in the recovery partition)....
For capitanpikefix to work, SIP must be disabled.
For BOOT64 to work, the Sandbox compatibility bundle must be correct, and then SIP can either be enabled or disabled. (I have a feeling that Apple may have changed things with 10.11.3 or 10.11.4 that will stop BOOT64 from working with SIP enabled - it will work if SIP is disabled. I'm still investigating!)
As a simple rule:
If in doubt, disable SIP first!
Last edited: