What Is SIP and How to Disable It?

In 2015, Apple introduced a security feature in OS X El Capitan (10.11) designed to protect system files and user data from malware. It is called System Integrity Protection (SIP, also known as rootless).

Why You Might Need to Disable SIP

For example, you may want to downgrade iTunes after an update or remove a pre-installed Apple app such as Safari, iTunes, or Photos. While SIP is enabled, those apps cannot be removed. Disabling SIP gives you that option.

Some patched or modified applications also require SIP to be turned off for full functionality, depending on how their activation is implemented.

Important: Starting with macOS 11 Big Sur, Apple changed how system security works. Users no longer have write access to the System volume—only read access—and disabling SIP does not change that. Apple also moved most built-in apps into the sealed System volume. Safari is the main exception.

How to Disable SIP

You cannot disable SIP from within macOS itself—that would defeat the purpose of the protection. You must boot into Recovery mode and run commands in Terminal.

1. Boot your Mac into macOS Recovery

Intel Mac: Restart your Mac. As soon as the screen goes black, press and hold Cmd + R until the Apple logo appears. When loading finishes, you will be in Recovery mode.

Apple Silicon: Shut down your Mac, then press and hold the power button for about 10 seconds. Select Options. You may be asked for an administrator password.

If macOS boots normally instead, you likely pressed the key combination too late or released it too early. Restart and try again.

2. Open Terminal from the Utilities menu

3. Run the following command and press Enter:

csrutil disable

Note: not every patched app requires full SIP disable. For a partial disable, use:

csrutil enable --without fs

This disables SIP only for the file system, without affecting Kernel Extensions or NVRAM.

4. Restart your Mac.

Sometimes disabling SIP can cause your Mac to boot into Recovery repeatedly instead of normal macOS. If that happens, hold ⌥ Option (Alt) during startup to open the Startup Manager, select your system disk, and press Enter.

Additional Notes

You do not have to leave SIP disabled permanently. After completing the steps you need (such as launching a specific app), boot back into Recovery mode and re-enable protection with:

csrutil enable

To check SIP status, run:

csrutil status

Terminal will show whether SIP is enabled or disabled.
This works in both normal macOS and Recovery mode.

Learn more about SIP on Wikipedia, Apple Support, or the Apple Developer documentation.