There are a few legitimate reasons to disable SIP, but too often I see people turning it entirely off, rather than just disabling the parts that are in the way:

There are a few legitimate reasons to disable SIP, but too often I see people turning it entirely off, rather than just disabling the parts that are in the way: csrutil enable --without kext csrutil enable --without fs csrutil enable --without debug csrutil enable --without dtrace csrutil enable --without nvram If you want to load some untrusted kernel extension, the first one will let you do so, but still keep all the other SIP protections on. If you want to use DTrace, use the corresponding flag. Etc. You can mix and match flags.