csrutil #

Created by Megan Carney (https://infosec.exchange/@PwnieFan)

Description ##

Used to enable/disable SIP, configure netboot and authenticated-root settings

Paths ##

• /usr/bin/csrutil

Use Cases ##

Disable SIP ##

disable SIP (System Integrity Protection) - requires booting into recovery mode

csrutil disable

Disable authenticated-root ##

When authenticated-root is disabled, booting is allowed from non-sealed system snapshots - requires booting into recovery mode

csrutil authenticated-root disable

Add a netboot server ##

Insert a new IPv4 address in the list of allowed NetBoot sources

csrutil netboot add <address>

Map infrastructure ##

List allowed NetBoot sources

csrutil netboot list

Detections ##

• No detections at time of publishing

Resources ##

• Discussion on how SIP interacts with bless and netboot