Explaining OS X El Capitan Security Changes - Workarounds and Current Information

[alexlizn]

Hi, espfutbol94:
I ran into the same problem as yours--disabling SIP in Clover Configurator but 'csrutil status' output still says SIP is enabled.

This is what worked for me:

1. Mounted EFI partition with EFI Mounter v3 (http://www.tonymacx86.com/downloads.php?do=file&id=280)
2. Find the Clover config.plist file
3. Open it in XCode
4. Edit RtVariables and set it to 0x67 (which is completely disabled)
5. Edit BooterConfig to 0x28
6. Save the change when you exit XCode (a message will pop up asking you to confirm)
7. Reboot
8. Issue 'csrutil status' to confirm SIP status

I read on this forum that we shouldn't use any Text Editor to edit config.plist file because it is not a regular text file. XCode is the default editor for this .plist file on MAC OS X, so I guess Mac knows it better than us.

For some reason, Clover Configurator didn't work for me. First of all, Clover Configurator doesn't display the current value of these two variables. This makes me nerves when I am about to change the value.

hope it helps!
alex

 

[RehabMan]

I read on this forum that we shouldn't use any Text Editor to edit config.plist file because it is not a regular text file. XCode is the default editor for this .plist file on MAC OS X, so I guess Mac knows it better than us.

A .plist is "regular text", but it is very easy to create a corrupt file with a bad edit when editing as plain text. Especially if you don't know XML/plist syntax.

 

[primac]

Same here guys, currently I've kept SIP Partially disabled, this probably isn't the best thing to do? But if I enable SIP after a few reboots it stops working. The only way I've managed to get it consistent is with SIP Partially disabled - any ideas?

Geez, I have the exact same problem as you guys, I also keep SIP partially disabled for now (0x3). As soon as I reboot audio stops working. Did anyone find a solution for this problem yet? I asked toleda for help today, I will see what he says.

 

[primac]

Same here guys, currently I've kept SIP Partially disabled, this probably isn't the best thing to do? But if I enable SIP after a few reboots it stops working. The only way I've managed to get it consistent is with SIP Partially disabled - any ideas?

Well I asked toleda about this and he said that something is causing a kext cache rebuilt with SIP enabled, and that this not an audio problem.

Could anyone point those of us with this problem in the right direction?

Thanks!

Update: For anyone still having this issue, this worked for me: http://www.tonymacx86.com/el-capita...capitan-10-11-3-sip-problems.html#post1218418

 

[sunny503]

Hey guys,
I have successfully installed el capitan 10.11.6 using clover ver 3676.
I am using smbios iMac2012, 1. Tried with different version of SMBIOS, but seems iMac 12,1 is pretty stable with my configuration.
Used RT variables 'BooterConfig=0x28 and CsrActiveConfig=0x67'.
Intermittently the message appears 'error loading kernel cache(0x9)' while booting from HD.
Attached the config.plist for reference.
Can anybody provide some solution to fix the issue.

 

[eazysnatch]

That is because SIP is enabled. I'm also struggling stop it. I was thinking that Boot loader is buggy because sometimes i have sound sometimes i don't and sometimes i cannot boot at all . So as the end i upgrade Clover to latest version so now there is NO sound but system boot normally.

Issues:
Audio codec is not found because SIP is enabled.
Cannot stop SIP with provided options in Colover config.plist

    <key>RtVariables</key>
    <dict>
        <key>CsrActiveConfig</key>
        <string>0x3</string>
        <key>BooterConfig</key>
        <string>0x28</string>
    </dict>

Tonight i will try completely disable SIP with CsrActiveConfig=0x67 and see what is going on.


#### I have the same problem as those guys. After couple of reboots sound just stop (don't ask how i catch that its a pain in the *** )####

haze295 said: ↑
Touching on this....

I have my system with SIP enabled, but using ALCCommand for my audio.

This places the RealtekALC.kext in EFI 10.11 Kexts.

I noticed that after a few reboots, my audio stops working and have to rebuild cache (whole process of SIP Disable....Rebuild..Enable). This gets the audio back perfectly however like I said after a couple reboots it's greyed out.


Should I place the RealtekALC.Kext into my SLE and then once I rebuild the cache, this issue should subside?



TIA
I am having the exact same problem on my build.
The Audio kext are the only one placed in System/labrary/ extensions and after a few reboots sound is greyed out.
Funny thing if i do nothing and just do about two to three reboots sound is back, without doing anything else.

I have no idea how to fix it?

 

[dasboot5]

Kexts that are injected (from EFI/Clover/kexts) are never cached. Only kexts installed to /S/L/E or /L/E are placed in the cache (and even then, only the kexts that are needed by your system).

RehabMan,
Could you explain this from the System Information Extensions list on my machine. The Atheros E2200 kext does not work Chipset is really E2201 from latest Multibeast install in /L/E but when I manually placed same kext in /Kexts/10.11 folder in EFI partition it works perfectly. This same kext using Yosemite with Chimera had no install problems with the Multibeast (no Clover).
I have two machines this one a GA Z97MX gaming 5 and a GA Z97 ITX board and both had no Ethernet working until I put kext in 10.11 folder in EFI partion using clover with 10.11.6 booting UEFI. Here is the info copied from System information:
SIP is partially disable with default setting from Multibeast:0x28

AtherosE2200Ethernet:

Version: 2.0.1
Last Modified: 8/12/15, 11:40 AM
Bundle ID: com.insanelymac.AtherosE2200Ethernet
Loaded: No
Obtained from: Not Signed
Kind: Intel
Architectures: x86_64
64-Bit (Intel): Yes
Location: /Library/Extensions/AtherosE2200Ethernet.kext
Kext Version: 2.0.1
Loadable: No
Authentication Errors:
Authentication Failures:
File owner/permissions are incorrect (must be root:wheel, nonwritable by group/other):
/Library/Extensions/AtherosE2200Ethernet.kext, Contents, Info.plist, MacOS, AtherosE2200Ethernet, Resources, en.lproj, InfoPlist.strings
Signature Validation Errors: Not Signed
Dependencies: Satisfied
Signed by: Not Signed

 

[Quickshooter]

Is there any benefit for having SIP completely disabled?

Right now I have it on 0x3 (partially disabled) but I wonder whether something would work better if I disable it completely (like sleep/wake issues)?

 

[wstrohm]

That is because SIP is enabled. I'm also struggling stop it. I was thinking that Boot loader is buggy because sometimes i have sound sometimes i don't and sometimes i cannot boot at all . So as the end i upgrade Clover to latest version so now there is NO sound but system boot normally.

Issues:
Audio codec is not found because SIP is enabled.
Cannot stop SIP with provided options in Colover config.plist

    <key>RtVariables</key>
    <dict>
        <key>CsrActiveConfig</key>
        <string>0x3</string>
        <key>BooterConfig</key>
        <string>0x28</string>
    </dict>

Tonight i will try completely disable SIP with CsrActiveConfig=0x67 and see what is going on.


#### I have the same problem as those guys. After couple of reboots sound just stop (don't ask how i catch that its a pain in the *** )####

I have found on my Skylake build that SIP remains enabled even with "0x67" in the CsrActiveConfig box in Clover Configurator. That leaves the NVRAM still protected. To completely disable SIP I have to input "0x77" in that box, which successfully disables SIP completely. Confirmed by Terminal.

 

[tonymacx86]

Check this out- Apple is shipping the late 2016 MacBook Pro (with touchbar) with System Integrity Protection (SIP) disabled by default!

System Integrity Protection Inexplicably Disabled by Default on Some New MacBook Pro Models