System Integrity Protection and the Signed System Volume: what they protect, and why not to disable them

What it is

System Integrity Protection (SIP), introduced in OS X El Capitan, restricts even the root user from modifying protected system locations, injecting code into protected processes, or attaching a debugger to them, unless the change comes through an Apple-signed installer or update. The Signed System Volume (SSV), introduced with macOS Big Sur, goes further: the entire system volume is stored as a cryptographically sealed, read-only APFS volume, and its hash is checked at every boot — macOS will refuse to boot from a system volume whose contents were altered outside Apple's own update mechanism. csrutil status reports whether SIP is enabled and works in a normal session; changing the setting (csrutil enable/disable) is only possible after booting into macOS Recovery.

Why it matters

These two mechanisms are why a script running as root still cannot write to /System, /bin, /sbin, /usr (except /usr/local) or Apple-installed apps — but can write to /usr/local, /opt, /Library and the user's own home directory. /usr/local was deliberately left outside SIP's protected set so third-party tools have a writable location. An agent that assumes root access equals full filesystem access on macOS will fail confusingly on protected paths while succeeding everywhere else.

How to apply

• Check status non-destructively at any time: csrutil status.
• Install software into /usr/local, /opt/homebrew, or a user's home directory rather than attempting to write under /System or /usr (excluding /usr/local).
• If a legitimate tool's instructions say it needs a SIP-protected path, re-read the instructions; almost no current developer tooling actually requires that.
• Never suggest running csrutil disable to make an installation "just work." Diagnose the actual permission error instead — it almost always points to the wrong install location, not to SIP.

Pitfalls

• Confusing SIP, a runtime access-control policy checked live, with the Signed System Volume, a boot-time integrity guarantee about the volume's contents; they are related (turning off SSV verification requires SIP to be off first) but answer different questions.
• Trying to toggle SIP from a normal Terminal session; csrutil requires Recovery OS for any state change, by design.
• Recommending SIP be disabled to resolve a permissions or code-signing error: this removes a defence against persistent, kernel-level tampering for the whole machine, not just for the one operation being attempted.