Solved> Disable system file protection in Big Sur!

[Henties]

Just to confirm, the "visibility" of available Big Sur updates depends on the SIP setting which in turn is controlled by the contents of
csr-active-config in opencore --> NVRAM --> Add --> 7C436110-AB2A-4BBB-A880-FE41995C9F82 -->csr-active-config.

csr-active-config=00000000 SIP fully on, updates will show if available.
csr-active-config=ff0f0000 SIP fully off, updates will NOT show if available.

For the time being I prefer leaving SIP off with csr-active-config=ff0f0000

Every now and then I just set SIP on, with csr-active-config=00000000, to test whether Big Sur updates are seeded by Apple.

The switching between the 2 SIP states would normally require NVRAM resets, but rather cumbersome and not necessary if one adds an entry into
opencore --> NVRAM -->Delete-->7C436110-AB2A-4BBB-A880-FE41995C9F82-->1=car-active-config

With this small addition you can change the Big Sur SIP environment by merely placing the desired value into csr-active-config, then reboot and you are golden, no need for a NVRAM reset at all.

Just for completeness, this I picked up from another site but cannot remember anymore wherefrom which unfortunately means that I cannot credit the original author who published this initially - sorry mate - if you discover yourself here.

A picture is always worth a thousand words, enjoy or destroy.

Greetings Henties

 

[esafeddie]

A picture is always worth a thousand words, enjoy or destroy.

 

[telepati]

csr-active-config=ff0f0000 SIP fully off, updates will NOT show if available.

This is wrong which I am using this value since Public Beta 1 and I am always getting updates without any problem.

 

[Henties]

This is wrong which I am using this value since Public Beta 1 and I am always getting updates without any problem.

Well I don't and many others as well.

Greetings Henties

 

[buddyjack2]

Just to confirm, the "visibility" of available Big Sur updates depends on the SIP setting which in turn is controlled by the contents of
csr-active-config in opencore --> NVRAM --> Add --> 7C436110-AB2A-4BBB-A880-FE41995C9F82 -->csr-active-config.

csr-active-config=00000000 SIP fully on, updates will show if available.
csr-active-config=ff0f0000 SIP fully off, updates will NOT show if available.

For the time being I prefer leaving SIP off with csr-active-config=ff0f0000

Every now and then I just set SIP on, with csr-active-config=00000000, to test whether Big Sur updates are seeded by Apple.

The switching between the 2 SIP states would normally require NVRAM resets, but rather cumbersome and not necessary if one adds an entry into
opencore --> NVRAM -->Delete-->7C436110-AB2A-4BBB-A880-FE41995C9F82-->1=car-active-config

With this small addition you can change the Big Sur SIP environment by merely placing the desired value into csr-active-config, then reboot and you are golden, no need for a NVRAM reset at all.

Just for completeness, this I picked up from another site but cannot remember anymore wherefrom which unfortunately means that I cannot credit the original author who published this initially - sorry mate - if you discover yourself here.

A picture is always worth a thousand words, enjoy or destroy.

Greetings Henties

When I enter ff0f0000 (OC 0.6.1) and reboot, doing a "csrutil status" in Terminal shows that every component of SIP is disabled except "Apple Internal," which still says "enabled" and informs me that the configuration is "unsupported." (See attached pic). Is this OK?

 

[Henties]

@buddyjack2 ff0f00000 disables SIP, provided you are already running Big Sur, such as beta 6.

Note: The SIP values that apply to Big Sur differ from those of earlier versions of macOS.

Thus if your Big Sur system is working as Apple intended, you will not be offered any Big Sur updates that Apple is seeding, in fact with that SIP setting you should get a message such as "Unable to check for updates", and that thus ends your effort. With 00000000, SIP is enabled and you will be offered the latest Big Sur update provided you are enrolled in either the Apple public or developer beta upgrade program. That is how Apple coded the upgrade process. Once you have the beta available to install it is subjected to more checks before an attempt at installation will actually commence.

An exception is the initial upgrade to Big Sur with beta 6, which lays the groundwork for later Big Sur updates and ensures that Big Sur "update integrity" can be maintained going forward with updates as and when they become available, as I attempted to explain above.

Hoping this helps a bit.

Greetings Henties


Greetings Henties

 

[buddyjack2]

@buddyjack2 ff0f00000 disables SIP, provided you are already running Big Sur, such as beta 6.

Note: The SIP values that apply to Big Sur differ from those of earlier versions of macOS.

Thus if your Big Sur system is working as Apple intended, you will not be offered any Big Sur updates that Apple is seeding, in fact with that SIP setting you should get a message such as "Unable to check for updates", and that thus ends your effort. With 00000000, SIP is enabled and you will be offered the latest Big Sur update provided you are enrolled in either the Apple public or developer beta upgrade program. That is how Apple coded the upgrade process. Once you have the beta available to install it is subjected to more checks before an attempt at installation will actually commence.

An exception is the initial upgrade to Big Sur with beta 6, which lays the groundwork for later Big Sur updates and ensures that Big Sur "update integrity" can be maintained going forward with updates as and when they become available, as I attempted to explain above.

Hoping this helps a bit.

Greetings Henties


Greetings Henties

Ah OK, that explains it: I'm still running Catalina 10.15.7. I usually keep SIP enabled (00000000), but reading this and other threads about disabling it via OC, and figured I'd give it a try. Thanks for the info !

 

[telepati]

Well I don't and many others as well.

Greetings Henties

I am still skeptical about this. Because I don't have any problems with FF0F000 as shown in the picture. I think the biggest reason OTA is not working is to play with Snapshots.

 

[Henties]

@telepati I wrote as follows, quoting myself below from a passage originally directed at @buddyjack2 because he originally and politely asked me to.

Quote
"Thus if your Big Sur system is working as Apple intended, you will not be offered any Big Sur updates that Apple is seeding....."
Unquote

This quote needs to be read and evaluated in conjunction with my complete response to @buddyjack2 's original question, in particular the words "if your Big Sur system is working as Apple intended" deserve special and careful consideration.

It is however clear from your reaction that you assume outright that your Big Sur installation is indeed perfect and working as Apple intended. My advice is that you stop being you own referee, rather investigate the subject matter in depth and on your own steam, as I have done, and acquire the knowledge and understanding which will enable you to forward your sentiments based on facts and not on what you observe from a possibly flawed system of yours.

I have the complete and decoded Big Sur csr-active-config bitmap at my disposal which details exactly which bit from that bitmap is responsible for which particular SIP action.

Arm yourself with that knowledge and then, once the playing field is level, you are welcome to approach me again.

You are naturally free to differ but it would then be best to air your views in a separate thread.

For me this topic is now closed, therefore, and for the time being, expect no further comments from me.

Greeting Henties

 

[scottkendall]

This quote needs to be read and evaluated in conjunction with my complete response to @buddyjack2 's original question, in particular the words "if your Big Sur system is working as Apple intended" deserve special and careful consideration.

Not sure it is working as intended by Apple even on a real Mac, my 2018 Mac Mini has been a bit finicky with the BS installs. Like the E-GPU connected to it needs to be disconnected, it has to be downloaded by the user that is installing it, sometimes it fails partway threw the install and then needs to be redownloaded, sometimes it gives me a boot drive error where it makes me pick the boot drive then I have to download it again.