macOS utilizes kernel permissions to limit writability of critical system files with a feature called System Integrity Protection (SIP). This feature is separate from, and in addition to, the hardware-based Kernel Integrity Protection (KIP) available on a Mac with Apple silicon, which protects modification of the kernel in memory. Mandatory access control technology is leveraged to provide this and a number of other kernel level protections, including sandboxing and Data Vault.
Mandatory access controls
macOS uses mandatory access controls—policies that set security restrictions created by the developer that can’t be overridden. This approach is different from discretionary access controls, which permit users to override security policies according to their preferences.
Mandatory access controls aren’t visible to users, but they’re the underlying technology that helps enable several important features, including sandboxing, parental controls, managed preferences, extensions, and System Integrity Protection.
System Integrity Protection
System Integrity Protection restricts components to read-only in specific critical file system locations to prevent malicious code from modifying them. System Integrity Protection is a computer-specific setting that’s on by default when a user upgrades to OS X 10.11 or later. On an Intel-based Mac, disabling it removes protection for all partitions on the physical storage device. macOS applies this security policy to every process running on the system, regardless of whether it’s running sandboxed or with administrative privileges.