Apple's efforts are already bearing fruit: since El Capitan, the only paths that root can change are in /Users/$USER and /usr/local. For example, you can no lon

Apple's efforts are already bearing fruit: since El Capitan, the only paths that root can change are in /Users/$USER and /usr/local. For example, you can no longer edit binaries in /bin or /usr/bin. Another example: root cannot attach the debugger to binaries that have been signed with restrictive entitlements. lldb will refuse to debug `/usr/bin/git`, for example. This has been the case for at least a year now.