Mac Security · Gatekeeper & App Safety · Lesson 4 of 5

System Integrity Protection

The lock on macOS itself, and why no normal app needs it off.

A lock on macOS itself

System Integrity Protection, or SIP, guards the core parts of macOS. Integrity means staying whole and unchanged. SIP keeps the system files exactly as Apple made them.

Here is what SIP protects:

• The folders that hold macOS itself, such as the System folder.
• Apps that came with your Mac, like Safari.
• Important running parts of macOS, so other programs can't take them over.

Normally, an administrator, an account allowed to make big changes, can change almost anything. SIP is different. Even with an administrator password, a normal app can't change these protected areas. Only Apple's own signed updates can.

Why so strict? Much malware wants to hide inside the system. There it could start every time, avoid antivirus, or change how your Mac works. If one bad app tricks you into typing your password, SIP still blocks it from rewriting macOS.

SIP does not get in your way day to day. Apps you install go in your Applications folder, which is not locked. Your own files are not locked either. You can install, update and delete normal apps as usual.

SIP is on by default. You can't switch it off from System Settings. It can only be turned off by starting the Mac in macOS Recovery, the special startup mode you met earlier, and typing a command there. That extra effort is on purpose. Turning it off by accident is nearly impossible.

Apple also adds another layer called the Signed System Volume. A volume is a section of the storage drive. On recent versions of macOS, the system lives on a read-only volume with a digital seal, and the Mac checks that seal at startup.

When an app asks you to turn SIP off

Sometimes a program's instructions say to disable SIP. To disable means to turn off. Treat this as a big red flag.

Almost no everyday app needs SIP off. Photo editors, games, office apps, video tools and browsers all work with SIP on. Apple built ways for honest apps to do their jobs without touching protected areas.

So who asks? Usually one of these:

• Cracked or pirated apps that need to change things Apple locked.
• "Cleaner" or "speed booster" apps that make big claims.
• Cheat tools for games.
• Malware dressed up as a helpful tool.

A few rare, specialist tools for developers or hardware tinkerers do ask. Those people usually know exactly why. If you are not sure why an app needs it, you are not that person, and that's fine.

The steps themselves are a clue. They will tell you to restart into macOS Recovery, open Terminal and type a command. You learned earlier that typing commands from strangers is a classic trick. Here it does real harm. With SIP off, malware can hide deep inside macOS and survive restarts.

If an app asks you to disable SIP:

1. Stop. Don't follow the steps.
2. Delete the app or the download.
3. Find another app that does the same job without this request.
4. If someone on the phone or in a chat is pushing you, hang up or close the chat.

If you think SIP may have been turned off, ask someone you trust for help. In macOS Recovery, they can turn it back on with a single command.