Using rEFInd to Manage SIP
Once rEFInd is installed, you can use it to manage SIP features; however, the rEFInd features needed to do this are disabled by default. You must uncomment or add two lines to your refind.conf file:
Note: Apple code samples and technical discussions are filled with the acronym "CSR." I don't know what this acronym means, but as it appears to be used in preference to "SIP" or "rootless" when referring to specific values, I used it in the refind.conf file's token names.
- showtools—This line specifies tools that appear on the second row of icons in rEFInd. The new tool for managing SIP is called csr_rotate, so you must uncomment showtools and add this option, or create a new showtools line.
- csr_values—This line lists the hexadecimal values through which you can rotate once csr_rotate is active on the showtools line. The trick to this token is selecting appropriate options. Several sites, such as this one, describe the meanings of the various options, but often not in much detail. Apple's own csrutil command sets values of 77 (disabled) or 10 (enabled). Note also that you specify hexadecimal values on this line, but without a leading 0x or other hexadecimal-notation indicator. If you specify gibberish values, or hexadecimal values higher than those used by SIP, rEFInd ignores the bad entries. Thus, if some of your values are being ignored, you should check your csr_values line for typos.
Note that
both of these options must be set appropriately. If either of them is missing or misconfigured, rEFInd will not display the SIP tool. A typical configuration using these features might look like this:
showtools shell,memtest,gdisk,csr_rotate,apple_recovery,windows_recovery,about,shutdown,reboot
csr_values 10,77
Once these options are set and you reboot into rEFInd, you should see a new shield icon on the second row, as shown at the right. When you select this tool, rEFInd identifies the next available CSR value from the list you specified and switches to that mode, rotating back to the start of the list once the end is reached. To confirm that the SIP mode has changed, rEFInd displays, for three seconds, a message identifying the new mode.
Whether or not you've enabled these SIP features in refind.conf, rEFInd displays the current SIP status on its "About" page:
[IMG alt="rEFInd presents a graphical menu for selecting your
boot OS."]
https://rodsbooks.com/refind/about.png
Note the line that reads "System Integrity Protection is disabled (0x77)" (highlighted in this screen shot). This line will be updated whenever you use the CSR rotation tool, so if you've specified a large number of values and have forgotten where you are in your rotation, you can use the About screen to figure it out.
If your Mac doesn't yet run macOS 10.11, rEFInd claims that SIP is enabled in the "About" screen. If you set the showtools and csr_values options as described earlier, you can adjust the SIP settings on such a Mac, but this will have no effect because neither pre-10.11 version of macOS nor any other OS honors these settings. On UEFI-based PCs, rEFInd won't display SIP status
unless you store the csr-active-config NVRAM variable in some way. If you do, rEFInd will enable you to adjust it, but it won't have any effect on the OSes most commonly found on UEFI-based PCs.
I provide these features in rEFInd as a convenience for developers and other advanced users who have a need to adjust their SIP settings. Using rEFInd for this purpose is much faster than booting into the macOS Recovery system to make these adjustments. I discourage others from playing with these settings, since changing them inappropriately could cause problems; that's why they're not enabled in rEFInd by default.