Contribute
Register

"csrutil enable" Doesn't work - Can't enable SIP.

Status
Not open for further replies.
Joined
Aug 22, 2017
Messages
389
Motherboard
Z390 Designare
CPU
i9-9900k
Graphics
RX 580
Mac
  1. iMac
Mobile Phone
  1. iOS
I have been trying to work with a troublesome driver which I suspect is relying on SIP being enabled in order to properly install. In response, I tried to re-enable SIP via terminal and when I checked my System Preferences > Security & Privacy I got this:
1548920379922.png

When I tried to re-install the kext (assuming SIP was enabled) I wasn't prompted to "allow" during install process. So I ran this command:
Code:
csrutil status
and got this response:
Code:
System Integrity Protection status: disabled.
I rebooted into recovery, opened up the terminal and executed the same command, but to my surprise the I got the same response after rebooting into macOS.
Code:
System Integrity Protection status: disabled.
What am I doing wrong?
 
Last edited:
I checked my System Preferences > Security & Privacy and got this:View attachment 383721
But for whatever reason I wasn't prompted to "allow" when installing 3rd party kexts. So I ran this command:
Code:
csrutil status
and got this response:
Code:
System Integrity Protection status: disabled.
I rebooted into recovery, opened up the terminal and executed the same command, but to my surprise the I got the same response after rebooting into macOS.
Code:
System Integrity Protection status: disabled.
What am I doing wrong?
Try this :
  • Launch Terminal from Dock or Utilities Folder
  • On Terminal type or copy and paste the following command:
sudo spctl --assess --master-disable [ENTER]
Type your Password:
  • There will be NO Terminal Output; your Computer name or login name will appear again on the Terminal prompt.[See image]
  • Open System Preferences> Security & Privacy >General Tab and look at the screen now.[See image]
 

Attachments

  • 1.SPCTL CMD.png
    1.SPCTL CMD.png
    12.3 KB · Views: 763
  • 2.Security & Privacy.png
    2.Security & Privacy.png
    60 KB · Views: 1,054
Try this :
  • Launch Terminal from Dock or Utilities Folder
  • On Terminal type or copy and paste the following command:
sudo spctl --assess --master-disable [ENTER]
Type your Password:
  • There will be NO Terminal Output; your Computer name or login name will appear again on the Terminal prompt.[See image]
  • Open System Preferences> Security & Privacy >General Tab and look at the screen now.[See image]
I am struggling with installation of a 3rd party driver and I suspect that previously disabling SIP (when I was still on High Sierra) and forgetting to re-enable it is throwing the driver off. So instead of "disabling" i'm trying to "enable." I think your command does the opposite, no? Or did I misunderstand?
 
I am struggling with installation of a 3rd party driver and I suspect that previously disabling SIP (when I was still on High Sierra) and forgetting to re-enable it is throwing the driver off. So instead of "disabling" i'm trying to "enable." I think your command does the opposite, no? Or did I misunderstand?
Your post and uploaded image was about Gatekeeper in System Preferences.
This deals with any 3rd Party Apps installation in macOS System .
CsrActiveConfig
deals with Bootloader (CLOVER) and kexts installation.
That you may use csrutil Status and Disable and ENABLE using selected values.
You can easily do it in Gui mode using CCG to open config.plist and go to SECTIONS> Rt Variables >CsrActive-config and change current value to 0x67
 
No.

With SIP enabled 3rd party kexts may not load correctly.
Understood. It was already disabled. I'm going to try re-enabling it by changing to 0x00. Is there anything that I need to do, like clearing cache or running kext utility to repair permissions before I do that?
 
Ok, I'm officially confused. :banghead: You state
Your post and uploaded image was about Gatekeeper in System Preferences.
This deals with any 3rd Party Apps installation in macOS System .
CsrActiveConfig
deals with Bootloader (CLOVER) and kexts installation.
...to me this sounds like there is no reason to make changes to CsrActiveConfig if all I'm trying to do is RE-ENABLE SIP at the macOS level.
That you may use csrutil Status and Disable and ENABLE using selected values.
This is the sentence that's throwing me off. Especially in light of what you say here:
You can easily do it in Gui mode using CCG to open config.plist and go to SECTIONS> Rt Variables >CsrActive-config and change current value to 0x67
To me this almost sounds like nothing I do to enable or disable SIP via the terminal command
Code:
csrutil enable
csrutil disable
will ultimately make any difference if my CsrActiveConfig is set to 0x67.
 
Last edited:
Understood. It was already disabled. I'm going to try re-enabling it by changing to 0x00. Is there anything that I need to do, like clearing cache or running kext utility to repair permissions before I do that?
Kexts inside CLOVER/kexts/Other folder is used during boot to use the hardware to reach the Installation screen in case of USB installer and the Login Screen if the booted device is the System Hard disk.

In addition, for the Hard disk macOS to work properly, it will use kexts loaded in its /Library/Extensions Folder and or /System/Library/Extensions folder.

Installing both apple kexts and modified non-apple kexts for Hackintosh, is done using kext installer Apps like Kext Utility|Kext Wizard|KextBeast to name a few Gui Tools used or using Terminal commands.
I have found the Kext Utility will not only install the kexts but also Repair Permission and Rebuild Cache automatically once you just drag and drop the needed kexts on to its interface once you launch the App and type in your Password.
I believe the other tools also do that but I have more confidence in the first; my personal choice.

It is indeed a very good idea to install the same ESSENTIAL kexts you had copied and Pasted on to CLOVER/kexts/Other folder to /L/E of the System Disk.
Many find a distinction between use of L/E and /S/L/E folders; they prefer NOT to install "third Party kexts" to /S/L/E.
I personally do not believe there is any problem with 3Rd party kexts in /S/L/E.
 
Status
Not open for further replies.
Back
Top