can't enable SIP (System Integrity Protection)

[Kuba77]

I just found out that SIP in my system (Catalina 10.15.2) is disabled. I tried to enable it in recovery mode (csrutil enable) and after restart SIP is enabled ONLY in recovery mode. I mean command csrutil status shows enabled (Apple internal) in recovery mode, but it shows disabled when I log on normally.

Anybody know what is the problem?

 

[fisherking]

how did you disable it in the first place? csrutil enable should enable it in recovery... but, if something happened while SIP was disabled, perhaps something's blocking it from being turned back on? (altho... what could that be??)

 

[Kuba77]

well, I really don't know how I could disable it, there is only one thing I can think of: Once I've installed Mojave on unsupported macbook early 2009 (excellent dosdude patch). At this time SIP was surly disabled. I'm using now Macbook air 2015, I've transfered all data and system via time machine and uninstalled patch as this Macbook fully supports Mojave. Then I've upgraded to Catalina. Maybe SIP was disabled all this time...

 

[fisherking]

probably. and you may need to back up your stuff, and do a clean install of catalina... if you can't otherwise sort it out.

but hopefully, someone with more knowledge will step in & help. good luck!

 

[Kuba77]

I've found this Dosdudes old tweet, this may be relevant:

With the new SIP disabler patch, it doesn't matter. High Sierra will think SIP is always disabled, even it is set as enabled in NVRAM.

https://twitter.com/x/status/978798171433455616

I guess it's possible, Dosdude used this patch in Mojave too, and maybe this patch is still enabled...

EDIT: I've found on this forum (Mojave unsupported thread):
Dosdude: SIP must remain disabled at all times when running Mojave Patcher, as having it enabled will cause issues with patched system files. SIPManager.kext is designed to ensure SIP is always disabled, regardless of the NVRAM preference. You should not attempt to enable SIP when running Mojave Patcher.

macOS 10.14 Mojave on Unsupported Macs Thread

SIP must remain disabled at all times when running Mojave Patcher, as having it enabled will cause issues with patched system files. SIPManager.kext is designed to ensure SIP is always disabled, regardless of the NVRAM preference. You should not attempt to enable SIP when running Mojave Patcher.

forums.macrumors.com

To be clear, I don't blame him at all, it's important that unsupported macs have SIP disabled, but now I have fully supported Macbook air.

 

[bogdanw]

To be clear, I don't blame him at all, it's important that unsupported macs have SIP disabled, but now I have fully supported Macbook air.

Do yourself a favor and make a clean install of Catalina. Restoring from back-ups, time-machines and so on it's like moving into a new home and taking all the trash from the old one with you.

 

[Kuba77]

Success! I've deleted SIPmanager.kext from library/extensions (It was part of Dosdudes patch), once again enabled SIP in recovery mode and after restart it's still enabled as I write this.

Thanks guys for help!

 

[fisherking]

Success! I've deleted SIPmanager.kext from library/extensions (It was part of Dosdudes patch), once again enabled SIP in recovery mode and after restart it's still enabled as I write this.

Thanks guys for help!

glad u got it sorted! and simple fix... 👍

 

[apple95]

FYI -- Just as a note -- 1Password, Vivaldi and iStatMenus won't start with SIP disabled.
(I'm trying to find this kext in my install to try removing it to see whether or not things start ok.. because while I can run Catalina, if enough apps won't start, not much point of running it...)