HighOS hardeningBLWK-MAC-003

System Integrity Protection is disabled

What this means

System Integrity Protection stops even root from modifying macOS system files, kernel extensions and protected processes. With it off, malware that gets root can tamper with the operating system itself and hide there.

How to fix it

Restart into Recovery (hold the power button on Apple silicon), open Utilities → Terminal, run csrutil enable, and restart. csrutil status should then print enabled.

Check it yourself

Run a scan and look for BLWK-MAC-003 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads macos_security and reports this check when:

sip_on_known == true and sip_on == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1562.001
• MITRE ATT&CK T1014

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001