How does a program modify /usr but I am unable to even with admin privileges? I have just installed latest Xquartz and FSL imaging software.  I noticed that there is a new symbolic link in /usr (i.e. /usr/X11R6) to /opt/X11. My understanding was that only Apple software could be certified/signed to modify /usr under the new SIP in El Capitan.  I am certainly unable to modify /usr directly with sudo so SIP is turned on.   

It definitely is new - I had a previous xquartz install with a /usr/X11 symlink created prior to El Capitan upgrade which remained in place.  However, FSL needs a /usr/X11R6 symlink which I tried to create manually to no avail because of SIP.  

After upgrading to latest Xquartz now I have both /usr/X11 and /usr/X11R6 symlinks.  It's not a 'problem' but I'm not clear how it got there.

Can someone explain how this works?
SIP disables everything (including the kernel) from modifying the specified directories. Disable it if you want to modify /usr.