4 ms·
You only need to boot into recovery mode once to change the setting, not every time. Turning it off isn't a big deal, and you have a valid reason to do so. Mos
by kogir 11y ago
You only need to boot into recovery mode once to change the setting, not every time. Turning it off isn't a big deal, and you have a valid reason to do so.
Most users never need any of the functionality restricted by SIP, and will benefit from the greater security it provides. Every step forward in exploit mitigation is usually a tradeoff - NX broke some programs. ASLR broke others. SIP is no different.
- Cieplak 11y agoPersonally I think I like having SIP. It means a webkit zero-day can't as easily load a kernel extension or edit firmware. I guess DTrace works by putting probes into other processes, so even though it is only "reading" system information, it's only able to instrument the data it reads in the first place by mutating other running processes.
- gdavisson 11y agoYou can also selectively disable the dtrace restrictions, while leaving the other SIP restrictions intact, with "csrutil enable --without dtrace" (in Recovery mode).