“restricted” folder/files in OS X El Capitan

问题

After upgrading from OS X Yosemite to OS X El Capitan Developer Preview, I tried to edit /System/Library/LaunchDaemons/ssh.plist to change the default SSH port to a custom one. This is the process I\'ve been using for a couple of years.

The problem is that El Capitan doesn\'t allow me to change anything in this folder (not even with \"sudo\"). The folder and its files are marked as \"restricted\" when I list the contents with \"ls -lO\". The same folder listing in previous versions of OS X does not show \"restricted\".

Is this something new to OS X El Capitan? How can I edit files/folders that are \"restricted\"?

I found out this is due to a new feature introduced in El Capitan called \"SIP\" (System Intregrity Protection).

Read more here: https://forums.developer.apple.com/thread/4731?q=SIP

Unfortunately, no one suggested a way of editing \"restricted\" files/folders without actually disabling SIP.

回答1:

You can also temporarily disable SIP the following way

reboot
as soon as you hear the "Mac sound" on the grey screen, press Cmd+R to enter Recovery mode
Open Utilities->Terminal
Run the command csrutil disable
Reboot, you'll land in the normal OS with SIP disabled
do all the changes you'd like to do
Reboot again
as soon as you hear the "Mac sound" on the grey screen, press Cmd+R to enter Recovery mode
Enable SIP with csrutil enable
Reboot again
done

回答2:

Until 10.11 unprotects certain files in /System/Library or allows you to do it yourself, the only way without disabling SIP would be to make a different service by coping the file somewhere else, like:

sudo cp /System/Library/LaunchDaemons/ssh.plist /Library/LaunchDaemons/ssh.plist

And then instead of using the Sharing panel in System Preferences, you would manage the service yourself:

sudo launchctl unload /Library/LaunchDaemons/ssh.plist
sudo launchctl load -w /Library/LaunchDaemons/ssh.plist

回答3:

I would suggest you try adding whatever arguments you need to a plist in /Library/Preferences/. For example, in my case I needed to make a slight alteration to mDNSResponder to add the AlwaysAppendSearchDomains flag. As suggested by "bwells" on the Apple developer forums, I just had to do

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist AlwaysAppendSearchDomains -bool YES
sudo launchctl load /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

This is a much cleaner approach and persists across reboots and should also survive an upgrade (at least during the betas my manual changes after disabling SIP were overwritten). Note, as far as I know this is new to El Capitan.

回答4:

You can also leave SIP enabled while disabling the filesystem management. Reboot in recovery mode and run:

csrutil enable --without fs

This will allow you to change permissions as needed.

回答5:

Just boot into "Recovery" mode by pressing "CMD+R" while rebooting.
Open Terminal
Your disk will be mounted in /Volumes/Macintosh HD
Delete files via "rm" : you have absolute control in that terminal.

回答6:

I use carbon copy cloner to make clonable backups... and have several in rotation.

According to mike at bombich "SIP only applies to the volume you're currently booted from, so [one can] boot from the backup volume to delete [files]".

I did use johannes' answer (recovery drive, csrutil enable/disable), but that requires reboot —> recovery drive —> turn sip off —> reboot —> delete crap —> reboot —> recovery drive —> turn sip back on —> reboot ... four reboots.

But booting from a clone and seeing the original drive as a secondary drive would allow you to delete problematic files in two reboots... yes?