No Recovery Partition on Fusion Drive so I cannot disable SIP

[BuleepMan]

I was attempting to disable System Integrity Protection on an El Capitan public beta 5 installation on the second partition on my 3T Fusion Drive and found that there was no Recovery Partition on the partition. The Recovery Partition that was available was the Internet online/download from Apple version and did not have the Security Configuration option. The EC install on the partition came from cloning an install from an external drive. EC copied over well but no Recovery Partition so I cannot disable SIP.

Complicating matters is you can only have 2 partitions on a Fusion Drive (why I don't know). Therefore I do not even know if a Recovery Partition can be created or copied over. Curios though, Techtool Pro 8 did create their version of an emergency partition with no effects on the Fusion Drive.

Questions:

1. Does anyone know how to create a Recovery Partition without blowing everything away and starting a fresh install? I have a glacially slow Internet connection (averages 1-2 MB/sec) and it literally would take a day or two to download and install all 4 beta updates. Personal gripe: why can I not download the beta 5 installer so I can install on multiple machines without repeating the downloads?
   or
2. Does anyone know how to copy the Recovery Partition onto the Fusion Drive?
   or
3. Is there another way, perhaps using Terminal commands, to disable SIP?

Thanks all for any responses, Jim

 

[DeltaMac]

Here's the word....
If you download the public beta installer from the App Store, currently you get the full install which includes the latest PB5.
So, no multiple restarts with multiple large downloads - only one download, which will still take a _long_ time to download more than 6GB on your connection. But that's all you would currently need for a PB install.
The installer automatically runs when the download completes, so Quit the installer app, so you can make a bootable installer flash drive from that downloaded installer app. There's several methods to do that, but the good utility DiskMakerX makes that easy. You just need a minimum 8GB flash drive, and you can use the result to install on any supported Mac.
(hint - the DiskmakerX app won't find the installer, unless you rename the El Capitan installer app to "Install OS X Yosemite". Until the developer releases a new version of DiskMakerX, that simple rename is what allows DiskMakerX to work with the PB installer. )

 

[BuleepMan]

Here's the word....
If you download the public beta installer from the App Store, currently you get the full install which includes the latest PB5.
So, no multiple restarts with multiple large downloads - only one download, which will still take a _long_ time to download more than 6GB on your connection. But that's all you would currently need for a PB install.
...

I thought of that but when I open the App Store and check the Purchased to download El Capitan, it still has the July 9 date, the original release of beta 1. If I download that file, will it be the beta 5 version?

 

[DeltaMac]

July 9 is the date that YOU first downloaded the beta, and coincidentally is exactly the same date that I show in the Purchased list.
Trust me on this, and I have downloaded the beta installer more than 10 times since that date (don't ask!)
Every time the download would show that exactly 6.00 GB would download, and would be that first released version of PB. Suddenly last week, after the PB5 was available, that download changed to 6.08GB (IIRC), and it rolls in all updates to make the build 15A262e (current as of today)
The date that you see is NOT the date of the version, it's the date that you first added that to your App Store list (your first download. There's no way, AFAIK, that you can discover what you get until you download it.
I have no reason to think that you would get anything other than the latest version, same as I get. That will be the version released for downloads on Aug 18, according to what I downloaded just yesterday.
So, yes, download that PB from the App Store, and you get the complete PB5 - not just an updater.

 

[Shirasaki]

Talking about disabling SIP, since I have been told Apple is trying to disable the ability to disable SIP in final release, my possible workaround is using systems other than OS X to modify core system files outside OS X. Then none of such protection would be able to stop you from modifying core system files, even the SIP.

If Apple do checksum of core system files upon startup, then, this may be a real problem, when using this way.

 

[tywebb13]

A fusion drive will have core storage by default. And that prevents the recovery partition from showing up in the startup manager you get when you boot up with holding the option key.

Yosemite and El Capitan installers also introduce core storage on other types of computers that would not otherwise have it. In this case it can be reverted back to normal because these installers use a convert command to create the core storage. But I don't think you can do that on fusion drives.

So it is likely that you do have a recovery partition but just can't see it due to core storage.

Nevertheless if you do have a recovery partition, you should be able to startup from it by booting up with holding Command + R.

In the unlikely event that you actually don't have a recovery partition you can create one as follows:

1. Download the Lion Recovery Update from https://support.apple.com/kb/dl1464?locale=en_US . (And before you ask, YES. I mean LION recovery update!) Make sure it is in your downloads folder. If you still happen to have the El Capitan installer somewhere, right click on the Install OS X El Capitan Public Beta.app file and click Show Package Contents. Go to Contents/SharedSupport/. Copy the InstallESD.dmg file into your Downloads folder. If you don't still have the installer, you can get it again by redownloading from your purchases tab in your mac app store.

2. Download and decompress the file recovery.sh.zip from http://4unitmaths.com/recovery.sh.zip and move recovery.sh into your Downloads folder if it's not there already.

3. Open Terminal and type the following commands:

chmod +x ~/Downloads/recovery.sh
sudo ~/Downloads/recovery.sh

4. Wait a few minutes for it to finish and return back to a prompt. If you don't have core storage, reboot with holding down the option key to test your recovery partition. Or use Command + R if you have core storage.

------------------------------------------

As a side note, this method is generally quite useful to update your recovery partition too without having to run the full installers because delta and combo updates don't update recovery partitions.

A second method to update the recovery partition is to run the full installer - even if your main partition is already up-to-date.

There is a third method too which apple unfortunately only occasionally release and certainly not for every version - called Recovery HD Update. It was good that for PB5 and DP7 apple released a Recovery HD Update.

I prefer the first method because running full installers will reintroduce core storage and I don't want to keep reverting my partitions every time I update. And although the third method is a very desirable method because it doesn't require a full installer, it can't be relied on for every update because apple only release Recovery HD Update once in a blue moon and certainly not for every update.

 

[tywebb13]

So I hope that answers your questions about the recovery partition.

Now for SIP in PB5 or DP7 this has already been answered in apple's developer forums at https://forums.developer.apple.com/thread/15149

 

[BuleepMan]

Wow, thanks everyone for all the great options. I have lots of things to try. Now if I could only get the current beta file to download quicker. Note the screen capture. The download has already been running 1 ½ hours. Sigh.

 

[KALLT]

Talking about disabling SIP, since I have been told Apple is trying to disable the ability to disable SIP in final release

Apple said that they will keep this option open, albeit for developers to develop unsigned kernel extensions. They seem to have expanded the csrutil operation in the latest beta, which suggests that this is a work in progress. Maybe they just disabled the GUI for now, maybe they don’t want to have the GUI anymore and only the command-line operation.

 

[BuleepMan]

My Progress: I am posting again because I haven't been able to try any of your solutions and I an seeking some sympathy feedback, lol. After 4 hours downloading El Capitan beta 5, I only have 1.57 GB of 6.07 GB. Worse is the estimated download time of 2 days 9 hours. AAAAARRRRRGGGGG!

 

[BuleepMan]

Remember when I said I had a glacially speed Internet access?
Remember when I posted several hours ago with a graphic indicating 2 days and 9 hours to download?

Well there has been progress. Eight hours into the download, I have nearly 43% of El Capitan downloaded with an estimated download time of 1 day 9 hours left. Whoo hoo!

Sigh!

 

[DeltaMac]

Do you have any options for using a faster internet connection - just to download something large like the OS X installer?
Friend's house with a faster internet?
Apple store?
Coffee shop?
Library?

I realize that some of those would be _uncomfortable_ for some users, but still a choice
Or, ask a Mac user friend to download the OS X installer for you?

 

[BuleepMan]

Do you have any options for using a faster internet connection - just to download something large like the OS X installer?
Friend's house with a faster internet?
Apple store?
Coffee shop?
Library?

I realize that some of those would be _uncomfortable_ for some users, but still a choice
Or, ask a Mac user friend to download the OS X installer for you?

I am disabled and live in an independent living facility. Unfortunately, getting out and around is problematic for me. I am new here and they recently discovered my prior computer science teaching and my IT work. They asked if I would be willing to help out, maybe hold classes for other residents. I plan to exploit the situation to get better IP access and better TV selections. TV here is horrid too, lol. Don't worry, I am griping here because I have nothing but time on my hands and I have an audience. El Capitan will eventually download.

Look! El Capitan is nearly half way downloaded and I now only have another 8+ hours to go, lol.

Check this out. I just ran an Internet speed test:

I probably should stop posting this irrelevant information, lol. I/ll stop now.

 

[BuleepMan]

I thank everyone for your help and for taking the time to offer me suggestions. Unfortunately, after hours and hours of waiting and working, I have been unable to install the El Capitan beta 5 Recovery HD on my external SSD attached to my 2014 iMac (3.5 GHz i7, 24 GB RAM, 3TB Fusion Drive, external USB SSD, external USB HD) that contains the command to disable SIP. Therefore I cannot disable SIP. I want to disable SIP so I can use TotalFinder.

What I have tried/done:

• Downloaded a fresh El Capitan beta 5. That took 16 hours and 15 minutes on my incredibly slow Internet connection. I reinstalled beta 5 over the current installation but it did not create a Recovery HD on the SSD which has the command to disable SIP. The Recovery HD is a version without that command available.
• I tried the excellently written directions from tywebb13 that used the Lion Recovery Update. There is a replacement Recovery HD but it also does not have the command to disable SIP.

I am frustrated and confused. It doesn’t make sense to me that the Recovery HD isn’t complete with the disable SIP command. Does anyone have any other idea before I resort to reformatting the SSD and installing everything over again? For anyone who has the time to review a lot of information, I have an edited copy of the iMac’s System Report below. I have highlighted the pertinent information about the SSD’s and HD’s. Thanks again,

Jim

USB 3.0 BUS WITH A 512 GB SSD INSIDE: (THE BOOT DISK WITH EL CAPITAN BETA 5 INSTALLED)
——————-> The iMac is booted from this external SSD with El Capitan beta 5 installed.
——————-> Note the absent a Recovery HD. What is strange is that when booting holding the Command-R into recovery mode, there is a Recovery HD available with OS X 10.11. Why it does show here is beyond my understanding.
——————-> Eventually this SSD will be installed into the DVD bay in my MacBook Pro and the DVD will be installed in the external USB shell.

Capacity: 480.1 GB (480,103,981,056 bytes)

Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
BSD Name: disk3s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
El Capitan SSD:
Capacity: 479.76 GB (479,760,007,168 bytes)
Available: 427.34 GB (427,337,277,440 bytes)
Mount Point: /Volumes/El Capitan SSD


INTERNAL 128 GB SSD (HAS MY SAFE WORKING YOSEMITE 10.10.5 INSTALLATION)

APPLE SSD SD0128F:
——————-> This is the internal SSD with my safe, backed up, working data with Yosemite 10.10.5 installed.
——————-> I also do not see a Recovery HD on this SSD either.

Capacity: 121.33 GB (121,332,826,112 bytes)
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
disk0s2:
Capacity: 120.99 GB (120,988,852,224 bytes)
Boot OS X:
Capacity: 134.2 MB (134,217,728 bytes)
BSD Name: disk0s3
Content: Apple_Boot
Volume UUID: 5834B70D-2073-3F09-9D61-D92FB77D74C8


WD MY PASSPORT 1TB (2 PARTITIONS):
(THIS IS THE EXTERNAL HD WITH THE EL CAPITAN INSTALLATION WHICH WAS CLONED TO THE USB SSD ABOVE.)
——————-> This is the external HD with my original El Capitan installation for testing purposes.
——————-> There is a Recovery HD on this HD.
——————-> This HD has 2 partitions: one Yosemite and the other El Capitan

Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
Yosemite Passport HD:
Capacity: 796.59 GB (796,593,975,296 bytes)
Available: 190.47 GB (190,472,097,792 bytes)
El Capitan Passport HD:
Capacity: 97.89 GB (97,891,086,336 bytes)
Mount Point: /Volumes/El Capitan Passport HD
Recovery HD: <—————————————————————- it exists on the external HD but didn’t copy over during the cloning.
Capacity: 650 MB (650,002,432 bytes)
BSD Name: disk4s5
Content: Apple_Boot
Volume UUID: 92CCD9C8-7BB3-379B-8AEF-4E6EB7DCFF28
eDrive: <———— Techtool Pro emergency boot partition
Capacity: 15 GB (14,995,783,680 bytes)
Available: 8.71 GB (8,708,497,408 bytes)
Writable: Yes
File System: Journaled HFS+
BSD Name: disk4s6
Mount Point: /Volumes/eDrive
Content: Apple_HFS
Volume UUID: AEDACC1F-B070-3B30-9BA0-FB1049B2C876

SOME WEBSITES WITH INTERESTING INFORMATION

I did find a number of websites with some interesting discussions but none of the suggestions worked either:

Article about making a Recovery HD: http://grahamgilbert.com/blog/2012/07/28/making-a-mountain-lion-recovery-hd/

Removing and rebuilding a malfunctioning Recovery HD partition: https://derflounder.wordpress.com/2...ilding-a-malfunctioning-recover-hd-partition/

Update / Create Lion RecoveryHD Partition Quickly Without Reinstalling: http://www.brunerd.com/blog/2012/03...eryhd-partition-quickly-without-reinstalling/

Restoring Missing Recovery Partition on Yosemite: http://apple.stackexchange.com/questions/160272/restoring-missing-recovery-partition-on-yosemite

 

[DeltaMac]

... I have been unable to install the El Capitan beta 5 Recovery HD on my external SSD attached to my 2014 iMac (3.5 GHz i7, 24 GB RAM, 3TB Fusion Drive, external USB SSD, external USB HD) that contains the command to disable SIP. Therefore I cannot disable SIP. I want to disable SIP so I can use TotalFinder.
...
SOME WEBSITES WITH INTERESTING INFORMATION

I did find a number of websites with some interesting discussions but none of the suggestions worked either:

Article about making a Recovery HD, ... (etc)

When I checked at the website for Totalfinder developer - looks like they will not offer a solution.
Unless Apple decides to drastically change their present direction, which in my view is proactively preventing modification of the system files and folders - then any third party app that tries to bypass those restrictions will be blocked.
There will likely be private APIs that Apple will not offer to share with developers.
I don't think Apple really wants to block third-party changes, but it's a result of building in protection against some forms of attacks (writing hidden files to areas that need to be protected from that attack), and Apple has decided to protect everything. One result of that direction, appears to be that utilities that want to offer alternative GUIs will have to go in other directions that don't involve modifying system files, and that probably means major rewrites.

Looks like if you want to use Totalfinder, that will mean that you can't upgrade to El Capitan.
Perhaps the developer doesn't want to work up an alternative, and that's their choice, too.

I think that the fact that the Totalfinder developer is giving up on El Capitan may mean that they realize that Apple is completely removing the option to disable SIP. So, on the basis of that, I suspect that even if you can get SIP disabled now, that the release version of El Capitan will re-enable SIP, and there won't be any option to disable. I could be wrong...

 

[tedson]

I have a similar problem as you. I have a 120GB internal SSD with FileVault 2 enabled(therefore running Core Storage). When I reboot holding down Command R, it boots into Internet Recovery rather than the Recovery Partition. If I disable FileVault 2, then I can boot into the Recovery Partition. I'm still trying to figure out why this happens, whether I have something misconfigured or if this is by design for security purposes. As shown below, there is a Recovery Partition, its just not accessible if FileVault 2 is enabled.

diskutil list

/dev/disk0 (internal, physical):

#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *120.0 GB disk0
1: EFI EFI 209.7 MB disk0s1
2: Apple_CoreStorage SSD 119.2 GB disk0s2
3: Apple_Boot Recovery HD 650.1 MB disk0s3

/dev/disk1 (internal, physical):

#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *1.0 TB disk1
1: EFI EFI 209.7 MB disk1s1
2: Apple_CoreStorage TimeMachine 999.9 GB disk1s2
3: Apple_Boot Boot OS X 134.2 MB disk1s3

/dev/disk2 (internal, virtual):
#: TYPE NAME SIZE IDENTIFIER
0: Apple_HFS SSD +118.8 GB disk2
Logical Volume on disk0s2
xxxxxxx-xxxx-xxxxx-xxxx-xxxxxxxxxxxxx
Unlocked Encrypted

/dev/disk3 (internal, virtual):
#: TYPE NAME SIZE IDENTIFIER
0: Apple_HFS TimeMachine +999.5 GB disk3
Logical Volume on disk1s2
xxxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxxxx
Unlocked Encrypted

 

[BuleepMan]

When I checked at the website for Totalfinder developer - looks like they will not offer a solution.

...

Looks like if you want to use Totalfinder, that will mean that you can't upgrade to El Capitan.
Perhaps the developer doesn't want to work up an alternative, and that's their choice, too.

I think that the fact that the Totalfinder developer is giving up on El Capitan may mean that they realize that Apple is completely removing the option to disable SIP. So, on the basis of that, I suspect that even if you can get SIP disabled now, that the release version of El Capitan will re-enable SIP, and there won't be any option to disable. I could be wrong...

I have been keeping up with the Binary Age blog about TotalFinder and they are a little more optimistic that they could write something that could work. Meanwhile, they do have the beta v1.7.1 available which works with El Capitan although some functions do not work (yet?). They are not sure if they will go any further developing the beta until they see a gold master version of El Capitan.

There also is interest there about Bartender. Surtees Studios, the maker of Bartender, has found a way around SIP. You do have to disable SIP temporarily then run a program they have available which makes some changes but you can then re-enable SIP and all Bartender features work. I bet we will see other developers finding other solutions in the not so distant future.

Jim

 

[mag01]

Have you tried this? http://musings.silvertooth.us/2014/07/recovery-partition-creator-3-8/ It won't work on that Fusion drive itself, but you can try to create the recovery partition at some external disk.

Or if you managed to create at least the Lion recovery partition - did you try to update it to El Capitan then?

 

[tywebb13]

Or if you managed to create at least the Lion recovery partition - did you try to update it to El Capitan then?

No. My instructions using the Lion Recovery Update does not create a Lion recovery partition.

It uses it in conjunction with the InstallESD.dmg file from the El Capitan installer together with the recovery.sh file to create an El Capitan recovery partition.

 

[tywebb13]

And for disabling SIP, this was available before from PB1-PB4 from the dropdown Utilities menu from the recovery partition like this:

But now with PB5 it looks like this:

So now you have to do it this way instead.

Whilst in the el capitan recovery partition open Terminal and run this to disable SIP:

/usr/bin/csrutil disable

Some parts of Totalfinder won't work in El Capitan even after disabling SIP though and this could be a bigger problem than SIP itself.

 

[BuleepMan]

No. My instructions using the Lion Recovery Update does not create a Lion recovery partition. It uses the Lion Recovery Program in conjunction with the InstallESD.dmg file from the El Capitan installer together with the recovery.sh file to create an El Capitan recovery partition.

I used the Lion Recovery Program but used the El Capitan InstallESD.dmg which I extracted from the El Capitan beta 5 installation program. The Lion Recovery Program doesn’t actually need Lion, just an installer named InstallESD.dmg as long as it is in the downloads folder along with itself and the recovery.sh file. It did create an El Capitan Recovery HD but it still is missing the command to turn off SIP.

 

[BuleepMan]

The screenshots in tywebb13 posting above is exactly my situation. It was there before beta 5 and now is gone. Next I will try the /usr/bin/csrutil disable suggestion and run TotalFinder. Yes I know that parts of TotalFinder are not working but the side by side windows are invaluable for me since I am constantly transferring files between folders on different Macs. I will keep up hope that a more elegant solution is discovered.

 

[BuleepMan]

I can gleefully report that TotalFinder v1.7.1 beta is up and running on my El Capitan beta 5 installation on my Fusion Drive. Yippie!

On the Apple Developers website (https://forums.developer.apple.com/thread/15149) are directions how to disable SIP using the /usr/bin/csrutil disable in Terminal. There is no need to boot into the Recovery HD. Check it out.

BTW: Did I mention that I am gleeful? giddy? smiling? Thanks for everyone who offered suggestions.

Jim

 

[tywebb13]

On the Apple Developers website (https://forums.developer.apple.com/thread/15149) are directions how to disable SIP using the /usr/bin/csrutil disable in Terminal. There is no need to boot into the Recovery HD.

I think to disable SIP you are supposed to do it in terminal from the recovery partition.

The post in apple's developer forums you linked to says:

/usr/bin/csrutil disable - Turns SIP off of the boot drive. Must be run from Recovery with a reboot to take effect.

Furthermore if you try to do it in terminal in your main partition and not your recovery partition it will just give you an error message:

csrutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.

 

[chrfr]

There is no need to boot into the Recovery HD.

To echo the post before mine, csrutil only works from the recovery partition.