Issue in disabling SIP (rootless) in El Capitan I have just installed El Capitan and I immediately experimented some problems because of the new SIP mechanism. Some tools I need as well as some tweaks did not work anymore. So, I decided to turn it off using the Apple "official" procedure (boot to Recovery, csrutil disable, reboot).

Now all my tools etc. are back working again. But if I check the SIP status using the csrutil utility I get:

$  csrutil status
System Integrity Protection status: enabled (Custom Configuration).

Configuration:
    Apple Internal: disabled
    Kext Signing: disabled
    Filesystem Protections: disabled
    Debugging Restrictions: disabled
    DTrace Restrictions: disabled
    NVRAM Protections: disabled

    This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.


The fact it says "status: enabled" is strange, but it does not worry me to much because, after, all the elements are disabled. I cannot rest easy with the sentence "...likely to break in the future and leave your machine in an unknown state".

Any ideas about this output?!
Thanks in advance
If all functions listed are showing as being disabled, SIP is actually completely disabled; it’s just confusingly worded.

My friend had the same problem so I did some research online and found out that it is a bug. There is a bug report on this message; it is bug ID 22361698 and is cross-posted to Open Radar here:

https://openradar.appspot.com/radar?id=4932475130216448

In the above link it says to:


Boot to Recovery HD
Open Terminal
Run the following command:
/usr/bin/csrutil disable


You should then receive the following output:


System Integrity Protection status: disabled.