System Integrity Protection explained: what SIP stops on a Mac
· 5 min read
System Integrity Protection (SIP) is a macOS security feature that stops anything, including an administrator or the root user, from changing the core of the operating system. It’s on by default, and for nearly everyone the answer to “should I turn it off?” is no. You can see whether it’s on with one Terminal command, and almost every problem people blame on SIP has a fix that leaves it alone.
What SIP protects
Apple’s support article names the locations SIP guards: /System, /usr, /bin, /sbin, /var, and the apps that come pre-installed with macOS. Third-party apps and installers can still write to /Applications, /Library and /usr/local, so everyday software installs are not affected.
Before SIP, an app that got administrator rights could overwrite system files, and malware could do the same. With SIP on, only processes signed by Apple with special entitlements, such as Apple’s own updates and installers, can modify those locations. Typing your password does not change that, and neither does sudo.
Apple’s older developer documentation describes two more limits. System processes can’t be attached to or have code injected into them while they run, and kernel extensions must be signed with a Developer ID certificate made for that purpose. That documentation is from 2015 and its details have changed since, so treat it as the origin of the idea.
Check whether it’s on
Open Terminal and run:
csrutil status
On a Mac with SIP on, it prints:
System Integrity Protection status: enabled.
The command only reads the setting. A Mac with SIP turned off prints “disabled” in the same sentence instead. You can also open System Information, choose Software, and read System Integrity Protection under the system software overview. That field comes from the same setting.
To see which items SIP is guarding, add the -O flag to ls:
ls -lOd /System /usr/bin /usr/local
Output from this Mac shows the word “restricted” on the protected folders and not on /usr/local:
drwxr-xr-x@ 10 root wheel restricted 320 19 Jul 2025 /System
drwxr-xr-x 917 root wheel restricted 29344 19 Jul 2025 /usr/bin
drwxr-xr-x 15 root wheel sunlnk 480 17 Aug 2025 /usr/local
What SIP is not
SIP is often mixed up with other protections that have different jobs.
- Not antivirus. SIP doesn’t scan for malware. It makes the system’s own files read-only to everything but Apple’s installers. Does a Mac need antivirus covers the rest of the picture.
- Not Gatekeeper. Gatekeeper decides whether an app you downloaded may open. SIP protects files after the app is running. Gatekeeper explained covers that check.
- Not FileVault. FileVault encrypts the disk so that someone who steals the Mac can’t read it. SIP controls who can change system files on a running Mac.
- Not the privacy prompts. The “would like to access” dialogs for Documents, Desktop or the camera are a separate system. That matters for the next section.
Why it isn’t the fix for “Operation not permitted”
Terminal’s “Operation not permitted” has more than one cause, and SIP is rarely the one behind it for everyday files. The two you’ll meet most often:
Privacy protection. In folders such as Desktop, Documents, Downloads or Photos, the cause is almost always a privacy permission for Terminal, and the fix is in System Settings, Privacy & Security. It has nothing to do with SIP.
SIP itself. If the path begins with /System, /usr (except /usr/local), /bin or /sbin, SIP is the likely cause, and that is working as designed. Software that needs a file there almost always has a supported place of its own, such as /usr/local or /Library.
Operation not permitted in Terminal walks through telling the causes apart, command by command, including the less common ones.
Who turns SIP off, and why you probably shouldn’t
SIP is switched off by developers who work on kernel extensions or low-level system tools, and by some security researchers. It can only be done from macOS Recovery, with the csrutil command; the man page says some of its commands need the Mac started up in Recovery. On an Intel Mac the setting is kept in NVRAM. On a Mac with Apple silicon, Apple’s Platform Security Guide says security policies apply to each installed copy of macOS, and turning SIP off there means accepting a lower security level, which Apple calls Permissive Security.
Turning it off removes the one thing standing between a mistaken command, or a malicious installer with your password, and the system itself. There’s a cost you can see on screen, too. With SIP off, the Apple Intelligence & Siri settings show this warning: “Apple Intelligence and other services may be unavailable when System Integrity Protection is turned off.”
If a tool tells you to disable SIP, look for a current version of the tool that doesn’t need it, or for another way to do the same job. If you do turn it off for a specific task, turn it back on afterward. macOS Recovery explained describes the place where that happens.
Questions
What does System Integrity Protection do on a Mac?
It stops every process, including root and administrators, from changing protected parts of macOS: /System, /usr, /bin, /sbin, /var and the apps that come with the Mac. Only Apple-signed system processes, like macOS updates, can modify them.
How do I check if SIP is on?
Open Terminal and run csrutil status. It prints “System Integrity Protection status: enabled.” when it’s on. The command only reads the setting and changes nothing.
Should I disable System Integrity Protection? Almost never. Most errors blamed on SIP, including “Operation not permitted,” are fixed another way, usually a privacy permission. Turning SIP off leaves the system folders open to malware and mistakes, and some Apple services warn when it’s off.
Is SIP the same as Gatekeeper or antivirus? No. Gatekeeper checks apps you download before they open, and antivirus looks for malware. SIP only protects macOS’s own files and processes from modification.