Why can't I change a restricted System file after doing csrutil disable?

Question

I want to change a file in /System/Library/Input Methods/PressAndHold.app/Contents/Resources/, but even after disabling csrutil in recovery mode, I still get this flags with -ls -lO <filename>:

-rw-r--r-- 1 root wheel restricted, compressed 6365 23 Aug 03:55 Keyboard-de.plist

UPDATE: I just figured out that I can change the ownership, so I should be able to cp and rm the file I want to change. Still, when I am opening the file with TextEdit, I can't do anything, but I think this should be possible too.

EDIT: To check if SIP is still on, type csrutil status in the terminal. With SIP on it's impossible to change those files as any user.

sudo nano worked just fine. Thanks for all the help!

When I am doing this sudo open Keyboard-de.plist I can't change anything. — Zin, Oct 04 '15 at 10:44
And sudo touch /usr/bin/crazy-name-which-doesnt-exist. If this fails, SIP is still active — nohillside, Oct 04 '15 at 10:49
It didn't fail! Thanks :D I just touched something crazy!
I believe I should enable this SIP again, righty? — Zin, Oct 04 '15 at 10:52

score 1 · Accepted Answer · answered Oct 04 '15 at 10:44

1

The restricted flag only applies with System Integrity Protection enabled. It tells SIP which files to protect. If you disable SIP, the restricted flag has no effect.

Disabling SIP doesn't give you permission to the files though. You'll still need sudo or change the permissions yourself to edit the files.

answered Oct 04 '15 at 10:44

grg

201,078

Thanks a ton. Still I haven't got, why nano is 'stronger' than textedit. – Zin Oct 04 '15 at 10:58
@Dennis TextEdit, like other GUI apps, run as the current user. sudo open … runs open as sudo, not TextEdit. If you want to open TextEdit as root, you need to run the binary as root. Alternatively, use a different GUI editor which handles edits to files like this—I recommend TextMate. – grg Oct 04 '15 at 11:00
Thanks for the quick response. This resolved the issue completely now. – Zin Oct 04 '15 at 11:08

Why can't I change a restricted System file after doing csrutil disable?

1 Answers1