Learn how System Integrity Protection protects Mac
System Integrity Protection is a security technology designed to help prevent potentially malicious software from modifying protected files and folders on a Mac. System Integrity Protection restricts the root user account and limits the actions that the root user can perform on protected parts of the Mac operating system.
Before System Integrity Protection, the root user had no permission restrictions, so it could access any system folder or app on a Mac. Software obtained root-level access when the administrator name and password was entered to install the software. That action allowed the software to modify or overwrite any system file or app.
System Integrity Protection includes protection for these parts of the system:
/System
/usr
/bin
/sbin
/var
Apps that are preinstalled with macOS
Paths and apps that third-party apps and installers can continue to write to include the following:
/Applications
/Library
/usr/local
System Integrity Protection is designed to allow modification of these protected parts only by processes that Apple signs and have special entitlements to write to system files, such as Apple software updates and Apple installers. Apps downloaded from the App Store already work with System Integrity Protection.
System Integrity Protection also helps prevent software from selecting a startup disk.