copying file under root got failed in OS X El Capitan 10.11

问题

I'm trying to copy under root file into /System folder. It works well on all previous OS X version but not on El Capitan 10.11

Here how I copy file under root in terminal:

MACMINI:~ myusername$ sudo su -
MACMINI:~ root# cp /Users/myusername/Desktop/myfile.plist /System/Library/LaunchDaemons/

As result I receive an error:

cp: /System/Library/LaunchDaemons/myfile.plist: Operation not permitted

回答1:

Considering that certain system directories are protected from being written at all (even with root) under OS X 10.11 (El Capitan) unless security measurements are disabled (see answer by Chris Ostmo) it's obviously a good idea to not modify those directories at all with custom system hacks.

Own LaunchDaemons should be installed to:

/Library/LaunchDaemons/

(not /System/Library/LaunchDaemons/)

回答2:

El Capitan now protects certain system directories in "rootless" mode (a.k.a. System Integrity Protection). If you run the command ls -lO /System/Library/LaunchDaemons you'll see that the directories and files under there are now marked as "restricted."

You can disable rootless mode like this:

Reboot into recovery mode (reboot and hold down Cmd-R)
Open a terminal
Use this command: csrutil disable
Reboot and run the command that worked prior to El Capitan

When you're done, it is highly recommended that you re-enable SIP by following the same steps, but using csrutil enable in step 3.

I ran into a problem with the same root cause while trying to get pear/pecl modules and macports/homebrew apps installed. Those typically need to install files into /usr/include and /usr/lib, which are also now restricted.

Note: Previous answers around the Internet about this problem give you instructions for modifying NVRAM settings, but Apple stated that the NVRAM method would stop working with El Capitan's public release. The GM release has already disabled the NVRAM workaround, so this answer should get you what you need moving forward.

UPDATE: This same method is applicable to macOS Sierra, and probably new macOS versions for the foreseeable future.