22361698: Mac OS X 10.11 (15A263a): "csrutil status" returns "enabled (Custom Configuration)" when SIP is disabled

[openradar-mirror]

Description

Summary:

When System Integrity Protection is disabled, running “/usr/bin/csrutil status” on the boot drive will give the following output:

---

computename:~ username$ csrutil status System Integrity Protection status: enabled (Custom Configuration).

Configuration: Apple Internal: disabled Kext Signing: disabled Filesystem Protections: disabled Debugging Restrictions: disabled DTrace Restrictions: disabled NVRAM Protections: disabled

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

---

Receiving “System Integrity Protection status: enabled (Custom Configuration)” is confusing. The "Custom Configuration" is that System Integrity Protection is disabled, but the status message may cause the reader to believe that System Integrity Protection’s protection is still enabled.

Steps to Reproduce:

1. Boot to Recovery HD
2. Open Terminal
3. Run the following command:

/usr/bin/csrutil disable

1. Boot to regular boot drive
2. Open Terminal
3. Run the following command:

/usr/bin/csrutil status

Expected Results:

Receive the following output:

System Integrity Protection status: disabled.

Actual Results:

Receive the following output:

System Integrity Protection status: enabled (Custom Configuration).

Regression:

1. Boot to Recovery HD
2. Open Terminal
3. Run the following command:

/usr/bin/csrutil disable

1. Receive the following output:

System Integrity Protection status: disabled.

Notes:

Both the Recovery HD and OS X boot volume were running OS X 10.11 (15A263a).

Product Version: Mac OS X 10.11 (15A263a) Created: 2015-08-20T15:55:33.723890 Originated: 2015-08-20T11:55:00 Open Radar Link: http://www.openradar.me/22361698

[openradar-mirror]

Modified: 2015-08-27T17:52:41.393830