They can no longer drop stuff in /usr/bin as of El Capitan, though. You can't even do it with root: [mason@IT-PC-MACPRO ~]$ sudo bash Password: [r

They can no longer drop stuff in /usr/bin as of El Capitan, though. You can't even do it with root: [mason@IT-PC-MACPRO ~]$ sudo bash Password: [root@IT-PC-MACPRO ~]# touch /usr/bin/nope touch: /usr/bin/nope: Operation not permitted [root@IT-PC-MACPRO ~]# cat 'nope nope' >> /usr/bin/nope bash: /usr/bin/nope: Operation not permitted