A list of places and files protected by El Capitan's new SIP

27 October 2015, 06:00

El Capitan introduces a new feature called System Integrity Protection (SIP) that amongst other things stops pretty much anybody but Apple writing to certain folders and files, typically related to the system or Apple’s own apps.

You can discover what these folders are with the following two commands issued in Terminal (which is in the Utilities folder of the Applications list):

cat /System/Library/Sandbox/rootless.conf
cat /System/Library/Sandbox/Compatibility.bundle/Contents/Resources/paths

There’s no need to invoke root. Any account can view this info.

You can also use the standard shell command ls -aOl when browsing a folder to view files/folders protected by SIP. They’ll be listed as “restricted”.

I know you’re a busy person, so here’s the output of the two commands listed above within my El Cap 10.1.1 system:

Keirs-MacBook-Pro:~ keir$ cat /System/Library/Sandbox/rootless.conf
				/Applications/App Store.app
				/Applications/Automator.app
				/Applications/Calculator.app
				/Applications/Calendar.app
				/Applications/Chess.app
				/Applications/Contacts.app
				/Applications/Dashboard.app
				/Applications/Dictionary.app
				/Applications/DVD Player.app
				/Applications/FaceTime.app
				/Applications/Font Book.app
				/Applications/Game Center.app
				/Applications/Image Capture.app
				/Applications/Launchpad.app
				/Applications/Mail.app
				/Applications/Maps.app
				/Applications/Messages.app
				/Applications/Mission Control.app
				/Applications/Notes.app
				/Applications/Photo Booth.app
				/Applications/Photos.app
				/Applications/Preview.app
				/Applications/QuickTime Player.app
				/Applications/Reminders.app
				/Applications/Safari.app
				/Applications/Stickies.app
				/Applications/System Preferences.app
				/Applications/TextEdit.app
				/Applications/Time Machine.app
				/Applications/Utilities/Activity Monitor.app
				/Applications/Utilities/AirPort Utility.app
				/Applications/Utilities/Audio MIDI Setup.app
				/Applications/Utilities/Bluetooth File Exchange.app
				/Applications/Utilities/Boot Camp Assistant.app
				/Applications/Utilities/ColorSync Utility.app
				/Applications/Utilities/Console.app
				/Applications/Utilities/Digital Color Meter.app
				/Applications/Utilities/Disk Utility.app
				/Applications/Utilities/Feedback Assistant.app
				/Applications/Utilities/Grab.app
				/Applications/Utilities/Grapher.app
				/Applications/Utilities/Keychain Access.app
				/Applications/Utilities/Migration Assistant.app
				/Applications/Utilities/Script Editor.app
				/Applications/Utilities/System Information.app
				/Applications/Utilities/Terminal.app
				/Applications/Utilities/VoiceOver Utility.app
				/Library/Preferences/SystemConfiguration/com.apple.Boot.plist
				/System
*				/System/Library/Caches
booter				/System/Library/CoreServices
*				/System/Library/CoreServices/Photo Library Migration Utility.app
				/System/Library/CoreServices/RawCamera.bundle
*				/System/Library/Extensions
				/System/Library/Extensions/*
UpdateSettings			/System/Library/LaunchDaemons/com.apple.UpdateSettings.plist
*				/System/Library/Speech
*				/System/Library/User Template
				/bin
dyld				/private/var/db/dyld
				/sbin
				/usr
*				/usr/libexec/cups
*				/usr/local
*				/usr/share/man
# symlinks
				/etc
				/tmp
				/var
Keirs-MacBook-Pro:~ keir$ cat /System/Library/Sandbox/Compatibility.bundle/Contents/Resources/paths
/System/Library/CFMSupport
/System/Library/CoreServices/Applications/Directory Utility.app/Contents/PlugIns/ADmitMac.daplug
/System/Library/CoreServices/CoreTypes.bundle/Contents/Library/iLifeSlideshowTypes.bundle
/System/Library/CoreServices/SecurityAgentPlugins/CentrifyPAM.bundle
/System/Library/CoreServices/SecurityAgentPlugins/CentrifySmartCard.bundle
/System/Library/CyborgRAT.kext
/System/Library/Extensions/IONetworkingFamily.kext/Contents/PlugIns/AppleRTL815XComposite109.kext
/System/Library/Extensions/IONetworkingFamily.kext/Contents/PlugIns/AppleRTL815XEthernet109.kext
/System/Library/Filesystems/DAVE
/System/Library/Filesystems/fusefs_txantfs.fs
/System/Library/Filesystems/ufsd_NTFS.fs
/System/Library/Fonts/encodings.dir
/System/Library/Fonts/fonts.dir
/System/Library/Fonts/fonts.list
/System/Library/Fonts/fonts.scale
/System/Library/HuaweiDataCardDriver.kext
/System/Library/LaunchAgents/com.paragon.NTFS.notify.plist
/System/Library/LaunchDaemons/com.absolute.rpcnet.plist
/System/Library/LaunchDaemons/com.intel.haxm.plist
/System/Library/LaunchDaemons/com.seagate.TBDecorator.plist
/System/Library/LaunchDaemons/de.novamedia.nmnetmgrd.plist
/System/Library/PrivateFrameworks/BrowserKit.framework
/System/Library/PrivateFrameworks/Helium.framework
/System/Library/PrivateFrameworks/LiveType.framework
/System/Library/PrivateFrameworks/ProKit.framework
/System/Library/PrivateFrameworks/iLifeSlideshow.framework
/System/Library/QuickTime/QuickTimeMPEG2.component
/System/Library/QuickTime/WiretapDataHandler.component
/System/Library/Services/KAVService.service
/System/Library/Services/Send to Kindle.workflow
/System/Library/StartupItems
/System/Library/USBExpressCardCantWake_Huawei.kext
/sbin/amconfig
/sbin/fsck_ufsd_NTFS
/sbin/mount_cifs
/sbin/mount_fusefs_txantfs
/sbin/mount_ufsd_NTFS
/sbin/mount_vmhgfs
/sbin/newfs_fusefs_txantfs
/sbin/newfs_ufsd_NTFS
/sbin/rpctool
/usr/X11
/usr/bin/FAHClient
/usr/bin/FAHCoreWrapper
/usr/bin/FAHViewer
/usr/bin/VBoxAutostart
/usr/bin/VBoxBalloonCtrl
/usr/bin/VBoxHeadless
/usr/bin/VBoxManage
/usr/bin/VBoxVRDP
/usr/bin/VirtualBox
/usr/bin/cups-calibrate
/usr/bin/escputil
/usr/bin/extlookup2hiera
/usr/bin/facter
/usr/bin/gnutar
/usr/bin/kashell
/usr/bin/kav
/usr/bin/nortonscanner
/usr/bin/nortonsettings
/usr/bin/nvconfigurator
/usr/bin/nvpmgr
/usr/bin/phidgetwebservice21
/usr/bin/puppet
/usr/bin/shake
/usr/bin/stkLaunchAgent.sh
/usr/bin/testpattern
/usr/bin/vagrant
/usr/bin/vboxwebsrv
/usr/discreet
/usr/include/gutenprint
/usr/lib/cshost
/usr/lib/gutenprint
/usr/lib/libMatroxMpeg2IFrameCodec.dylib
/usr/lib/libUFSDNTFS.dylib
/usr/lib/libgutenprint.2.0.3.dylib
/usr/lib/libgutenprint.2.dylib
/usr/lib/libgutenprint.a
/usr/lib/libgutenprint.dylib
/usr/lib/libgutenprint.la
/usr/lib/libnv6.dylib
/usr/lib/libnv6audit.dylib
/usr/lib/libnv6cli.dylib
/usr/lib/libnv6clit.dylib
/usr/lib/libnv6foreignras.dylib
/usr/lib/libnv6foreignrast.dylib
/usr/lib/libnv6gui.dylib
/usr/lib/libnv6guit.dylib
/usr/lib/libnv6http.dylib
/usr/lib/libnv6jobs.dylib
/usr/lib/libnv6jobst.dylib
/usr/lib/libnv6json.dylib
/usr/lib/libnv6jsont.dylib
/usr/lib/libnv6ndmp.dylib
/usr/lib/libnv6plugin.dylib
/usr/lib/libnv6plugint.dylib
/usr/lib/libnv6reports.dylib
/usr/lib/libnv6reportst.dylib
/usr/lib/libnv6scsi.dylib
/usr/lib/libnv6stats.dylib
/usr/lib/libnv6statst.dylib
/usr/lib/libnv6t.dylib
/usr/lib/libnv6xctl.dylib
/usr/lib/libnv6xpm.dylib
/usr/lib/libphidget21.jnilib
/usr/lib/libwkextmac.dylib
/usr/lib/pam/pam_centrifydc.so
/usr/lib/pkgconfig/gutenprint.pc
/usr/libexec/aksusbd
/usr/libexec/com.matrox.vpg.Agent
/usr/libexec/com.matrox.vpg.MaxAgent
/usr/libexec/cups/backend/cifs
/usr/libexec/hasplmd
/usr/local
/usr/netvault
/usr/sbin/AELWriter
/usr/sbin/cups-genppd.5.2
/usr/sbin/cups-genppdupdate
/usr/sbin/fsctl_ufsd
/usr/sbin/jamf
/usr/sbin/jamfAgent
/usr/sbin/m_agent
/usr/sbin/m_agent_upgrade
/usr/sbin/nipalsm
/usr/sbin/nmnetmgrd
/usr/sbin/nmnetmgrd_launchd
/usr/sbin/nmnetmgrd_launchd_MT
/usr/sbin/palModuleMgr.sh
/usr/sbin/proxyhelper
/usr/sbin/qmasterca
/usr/sbin/qmasterd
/usr/sbin/qmasterprefs
/usr/sbin/qmasterqd
/usr/sbin/rpc.net
/usr/sbin/rpcset
/usr/sbin/rpcstartup
/usr/sbin/setbufsize
/usr/share/centrifydc
/usr/share/cshost
/usr/share/cups/calibrate.ppm
/usr/share/cups/mime/pharos.convs
/usr/share/cups/usb
/usr/share/doc/facter
/usr/share/doc/puppet
/usr/share/gutenprint
/usr/share/locale/ca/gutenprint_ca.po
/usr/share/locale/cs/gutenprint_cs.po
/usr/share/locale/da/gutenprint_da.po
/usr/share/locale/de/gutenprint_de.po
/usr/share/locale/el/gutenprint_el.po
/usr/share/locale/en_GB/gutenprint_en_GB.po
/usr/share/locale/es/gutenprint_es.po
/usr/share/locale/fi/gutenprint_fi.po
/usr/share/locale/fr/gutenprint_fr.po
/usr/share/locale/gl/gutenprint_gl.po
/usr/share/locale/hu/gutenprint_hu.po
/usr/share/locale/it/gutenprint_it.po
/usr/share/locale/ja/gutenprint_ja.po
/usr/share/locale/nb/gutenprint_nb.po
/usr/share/locale/nl/gutenprint_nl.po
/usr/share/locale/pl/gutenprint_pl.po
/usr/share/locale/pt/gutenprint_pt.po
/usr/share/locale/ru/gutenprint_ru.po
/usr/share/locale/sk/gutenprint_sk.po
/usr/share/locale/sl/gutenprint_sl.po
/usr/share/locale/sv/gutenprint_sv.po
/usr/share/locale/tr/gutenprint_tr.po
/usr/share/locale/uk/gutenprint_uk.po
/usr/share/locale/vi/gutenprint_vi.po
/usr/share/locale/zh_CN/gutenprint_zh_CN.po
/usr/share/locale/zh_TW/gutenprint_zh_TW.po

[Via Der Flounder]

,

---

Leave a comment...

 
---