What should the permissions on the /EFI partition be? Currently, I am able to mount and edit the EFI partition without any special privileges. Is that correct?

I understand that the bootflags for SIP protected regions are stored in nvram which is inaccessible through bless, but it seems strange that I can manipulate the binary, and the changes will persist through a restart.

Is something wrong here? If not, why is it the case?
EFI partitions are formatted with a FAT32 file system. FAT32 doesn't provide POSIX file permissions. Whoever accesses an EFI partition in OS X/macOS has full ownership of all files and folders (777).

This even applies if you change your user with Fast User Switching.



Mounting of the EFI partition requires admin privileges though.