/Library/Keychains/System.keychain in restricted mode On OSX 10.12

A friend's keychain somehow got the "restricted" mode added to it. I know about csrutil disable from safe mode etc, I'd really like to know how it could've happened. He has no idea what he was doing back then, of course.

-r--r--r--@  1 root  wheel  -              0 Aug 5  07:38 .fl043D1EDD
-r--r--r--   1 root  wheel  -              0 Feb 17  2015 .fl947E1BDB
-rw-r--r--   1 root  wheel  restricted 56612 Jul 18 21:02 System.keychain
-rw-r--r--   1 root  wheel  -          33288 Sep 13 15:05 System.keychain-orig
-rw-r--r--   1 root  wheel  -          56612 Jul 18 21:02 System.keychain.2016-09-13.11:28:12
-rw-r--r--@  1 root  wheel  -          55936 Sep 13 23:05 apsd.keychain
Check the file /System/Library/Sandbox/rootless.conf - there is a list of all "restricted" directories of files.
Also this article could help