Explaining OS X El Capitan Security Changes - Workarounds and Current Information

[sselshamy]

I can't find any RtVariables entries in my working config.plist file, where I should find it?

attached my config.plist file

 

[DrTom]

How I can to check the current status of SIP whether enabled or disabled?

From Terminal issue the command: csrutil status

The result, if CsrActiveConfig is set to 0x3 in your config.plist, should look as follows:

 

[DrTom]

I can't find any RtVariables entries in my working config.plist file, where I should find it?

attached my config.plist file

I don't know if the specific location is critical, but in my config.plist it's just before the SMBIOS key, just as in TonyMac's sample config.plist.

</array>
</dict>
<key>RtVariables</key>
<dict>
<key>BooterConfig</key>
<string>0x28</string>
<key>CsrActiveConfig</key>
<string>0x3</string>
</dict>
<key>SMBIOS</key>
<dict>

 

[sselshamy]

Many thanks for your help, but I tells me that SIP is enabled and didn't show the rest of results

 

[sselshamy]

Also, I wonder how I have succeeded installing El Capitan without disabling SIP.

 

[DrTom]

Many thanks for your help, but I tells me that SIP is enabled and didn't show the rest of results

That's all you'll get if SIP is enabled.

To get anything else you have to add the lines I posted in my previous reply.

 

[PencilNotPen]

Thanks for the info! The article you linked doesn't give the commands, but I found them here:
http://www.idelta.info/archives/standalone-os-x-10-9-recovery-hd-backup/

On a real Mac, csrutil is used like this:
csrutil enable [--without kext|fs|debug|dtrace|nvram] [--no-internal]

For example, to use LiteIcon to edit my icons, I booted to Recovery and ran:
csrutil enable --without fs

And rebooted. csrutil status now gives:

System Integrity Protection status: enabled (Custom Configuration).

Configuration:
Apple Internal: disabled
Kext Signing: enabled
Filesystem Protections: disabled
Debugging Restrictions: enabled
DTrace Restrictions: enabled
NVRAM Protections: enabled

Hopefully this info can be of use to anyone else who also wants to partially disable SIP for kexts or Filesystem Protections on a real Mac.

 

[Felibonilla]

It look that new "Rootless" Security System is more annoying for some users.

I just update from Yosemite to El Cap and make a clean installation. After fix some features (USB3 and Realtek Audio) the system was just working fine. I installed Adobe CS6 and Pro Tools 10. Both apps is working fine right now but they have a critical bug: They can communicated with third party plugins. Premiere need .bundle files tom read AVCHD files and is not reading on El Cap. Pro Tools do not load AIR plug ins, which are default plug in for the app.


And


After hours looking for a solution, it appears that rootless is blocking this apps communication with third party plugins. I've tried a couple of things:

1. On my config.plist and just disable rootless by CsrActiveConfig: 0x67, check rootless=0 on Boot Section. Both shows me csrutil status as enable but disable, this way:



After that I desinstall and re-install all the Adobe CS6 suite hoping some change but nothing happens.

2. My second shot was change the rootless.conf by Terminal with this code

[FONT=Menlo]sudo nano -w /System/Library/Sandbox/rootless.conf[/FONT]

And add the .app and folders of my applications. (All CS6 .app and plugins from Library/QuickTime and Library/Video).

No one was useful. I believe this second solution is useless because it just make.app untouchable when rootless is enable, but do not allow communication between plugins and apps.

Premiere and ProTools still bug. The only way I see is to downgrade to Yosemite and someday update again.

 

[Walril]

Ethernet kexts, such as AppleIntelE1000e.kext, have a dependency... IONetworkingFamily.kext.

So... it only works when IONetworkingFamily.kext is in the cache. Rebuilding cache puts IONetworkingFamily.kext into the cache, not AppleIntelE1000e.kext. Kexts that are injected are never placed in cache (unless they also exist in /S/L/E, of course).

You can also use ForceKextsToLoad to force IONetworkingFamily.kext to load. I use this so it works at installation/recovery, for example.

Thanks for this. This probably explains why my NIC keeps going red and wont grab a dhcp.

 

[RehabMan]

Thanks for this. This probably explains why my NIC keeps going red and wont grab a dhcp.

Probably not. More to do with driver/kext choice.