Hi. So, are you saying we shouldn't worry about SIP on Monterey? Can I enable SIP now using OCLP-GUI (SIP/SecureBootModel check boxes), build and install to EFI, then disable SIP when I want to upgrade to 12.2? What do you recommend?
Do signed system volumes actually affect security related to remote access to local machines and potentially iCloud data via AppleID's? Or is it only relevant to encrypted hard disks and such?
Thank you.
I have a Macbook Pro 8,2 (Early 2011) with the defective AMD dGPU. Prior to sending it off to dosdude1 a couple of years ago to have him flash his deMux (to disable the AMD chip at HW level, and MBP only then sees the Intel HD3000 iGPU), I had to edit NVRAM parameters and then alter the .kexts in order for my MBP to work even in High Sierra, which is the last officially supported macOS for the MacBookPro8,2. In fact, due to this, it was a contributing factor to me using dosdude1's tool to upgrade to Mojave....I figured why not...and had been running Mojave on it until last week.
The point is, I HAD to disable SIP just to be able to boot my MBP8,2 and so, went thru all the research about it back then. AFAICT, the biggest thing about SIP is protecting the drivers (.kext) from malicious manipulation....but the downside is not being able tweak/optimize the relevent .kext if/when needed. While I can see the argument for it from a "Lowest Common Denominator" design perspective, I do not agree that it is the best approach when technically competent folks wish to optimize (or my case FIX) their computers. IMHO, lots of what Apple started doing a few years ago creates the perception of dumbing down their architecture "for the masses", at the expense of the Enthusiast / Tech-Savvy community...the very folks responsible for Evangelizing Apple products to their Microsoft brainwashed colleagues (The HW design changes to stop Memory and Storage upgrades is another example... Moving to Apple ONLY silicon for recent Mac products is another example IMHO. No problem with doing Apple Silicon CPU/GPU, but IMHO, they should offer both Intel and Apple solutions in their model families. But that is not the plan, because Apple no longer appears to care about the Enthusiast, or folks that have "Advanced" computing needs and would like to do so at reasonable (ahem) cost with Mac Products.
TLDR version:
AFAICS, Main thing with SIP is to protect .kext, and if you are technically savvy enough to be having this discussion about it, you likely don't have to worry about disabling it if needed. You likely aren't going to be engaging in stupid behavior that puts you or your data risk...whether SIP is enabled or disabled. If you aren't in that category, you probably shouldn't be looking to run unsanctioned macOS versions on your unsupported HW in the first place...in which case, just go buy a new Mac and be done with it.
