System Integrity Protection disabled by default on some Touch Bar MacBook Pros
Some -- but not all -- Touch Bar models of the new MacBook Pro are shipping with System Integrity Protection disabled, potentially exposing them to malware threats, according to discussions on Twitter.
The issue was called out by developers Jonathan Wight and Steve Troughton-Smith. The latter suggested that there seems to be no obvious trend, other than Pros with a function key row having SIP on as usual.
While Macs do have other safeguards, SIP has been on by default since OS X El Capitan, and limits root permissions -- mitigating the amount of damage malware can do if it does infect a system.
Apple is allegedly aware of the problem, and likely working on a software update. Technically confident Mac owners can turn SIP back on themselves holding down Command-R when booting, releasing when a progress bar appears, then selecting Terminal from the Utilities menu in recovery mode. Entering "csrutil enable" and restarting should complete the process.
The issue was called out by developers Jonathan Wight and Steve Troughton-Smith. The latter suggested that there seems to be no obvious trend, other than Pros with a function key row having SIP on as usual.
While Macs do have other safeguards, SIP has been on by default since OS X El Capitan, and limits root permissions -- mitigating the amount of damage malware can do if it does infect a system.
Apple is allegedly aware of the problem, and likely working on a software update. Technically confident Mac owners can turn SIP back on themselves holding down Command-R when booting, releasing when a progress bar appears, then selecting Terminal from the Utilities menu in recovery mode. Entering "csrutil enable" and restarting should complete the process.
Comments
csrutil statusWhere's the reports of it being enabled on some of the shipping "models"? They only talk about one or two instances of it being disabled. Could it be disabled due to the functionality of the Touch Bar, and they are still working to resolve some compatibility issues? Or is it merely an oversight on the configuration of "some" models?
Is there any indication of a potential compatibility issue, or have people who have enabled it been fine?
I suppose Apple would say if there was a reason not to enable it.
I like your stance, however, I must share w you that Gatekeeper and System Integrity Protection are two different scenarios.
SIP is enabled or disabled via the Command Line only.
But, I enjoyed your post.
Patrick
MacOvation