System Integrity Protection (SIP) can be enabled and disabled using
csrutil from OS X Recovery per Apple’s documentation. However, booting to Recovery is a local-only procedure and allows no remote access capabilities. I work remotely so it interests me to have capabilities to remotely change SIP status instead of walking a user thru the Recovery process which is daunting over the phone. We currently have NetBoot with Apple Remote Desktop (ARD) access in all offices and that can be leveraged for our needs.
The NetBoot environment by default doesn’t allow for
csrutil access to enable or disable SIP:
However, if we copy boot.efi from a Recovery partition and use it to replace the i386/booter file in the NetBoot NBI the NetBoot environment can adjust SIP’s status:
To extract the boot.efi first we have to determine which partition the Recovery OS is on and mount it. In this example the Recovery OS is on /dev/disk1s3 and is on an APFS formatted disk. Use
mount -t apfs /dev/disk1s3 /path/to/mountpoint to mount it to a mount point and copy the boot.efi file off:Now copy the boot.efi in the NBI’s i386/ directory, name it
booter and give it 664 root:admin permissions:
Now when I NetBoot to that NBI I can gain access with ARD and adjust SIP status with csrutil.