code.delx.au - refind/blob - docs/refind/sip.html

   1 <?xml version="1.0" encoding="utf-8" standalone="no"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
   3   "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
   4
   5 <html xmlns="http://www.w3.org/1999/xhtml">
   6 <head>
   7   <title>The rEFInd Boot Manager: rEFInd and System Integrity Protection</title>
   8   <link href="../Styles/styles.css" rel="stylesheet" type="text/css" />
   9 </head>
  10
  11 <meta name="viewport" content="width=device-width, initial-scale=1">
  12
  13 <body>
  14   <h1>The rEFInd Boot Manager:<br />rEFInd and System Integrity Protection</h1>
  15
  16 <p class="subhead">by Roderick W. Smith, <a
  17 href="mailto:rodsmith@rodsbooks.com">rodsmith@rodsbooks.com</a></p>
  18
  19 <p>Originally written: 10/31/2015, referencing rEFInd 0.9.3</p>
  20
  21
  22 <p>This Web page is provided free of charge and with no annoying outside ads; however, I did take time to prepare it, and Web hosting does cost money. If you find this Web page useful, please consider making a small donation to help keep this site up and running. Thanks!</p>
  23
  24 <table border="1">
  25 <tr>
  26 <td>Donate $1.00</td>
  27 <td>Donate $2.50</td>
  28 <td>Donate $5.00</td>
  29 <td>Donate $10.00</td>
  30 <td>Donate $20.00</td>
  31 <td>Donate another value</td>
  32 </tr>
  33 <tr>
  34
  35 <td>
  36 <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
  37 <input type="hidden" name="cmd" value="_donations">
  38 <input type="hidden" name="business" value="rodsmith@rodsbooks.com">
  39 <input type="hidden" name="lc" value="US">
  40 <input type="hidden" name="no_note" value="0">
  41 <input type="hidden" name="currency_code" value="USD">
  42 <input type="hidden" name="amount" value="1.00">
  43 <input type="hidden" name="item_name" value="rEFInd Boot Manager">
  44 <input type="hidden" name="bn" value="PP-DonationsBF:btn_donate_LG.gif:NonHostedGuest">
  45 <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
  46 <img alt="Donate with PayPal" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
  47 </form>
  48 </td>
  49
  50 <td>
  51 <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
  52 <input type="hidden" name="cmd" value="_donations">
  53 <input type="hidden" name="business" value="rodsmith@rodsbooks.com">
  54 <input type="hidden" name="lc" value="US">
  55 <input type="hidden" name="no_note" value="0">
  56 <input type="hidden" name="currency_code" value="USD">
  57 <input type="hidden" name="amount" value="2.50">
  58 <input type="hidden" name="item_name" value="rEFInd Boot Manager">
  59 <input type="hidden" name="bn" value="PP-DonationsBF:btn_donate_LG.gif:NonHostedGuest">
  60 <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
  61 <img alt="Donate with PayPal" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
  62 </form>
  63 </td>
  64
  65
  66 <td>
  67 <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
  68 <input type="hidden" name="cmd" value="_donations">
  69 <input type="hidden" name="business" value="rodsmith@rodsbooks.com">
  70 <input type="hidden" name="lc" value="US">
  71 <input type="hidden" name="no_note" value="0">
  72 <input type="hidden" name="currency_code" value="USD">
  73 <input type="hidden" name="amount" value="5.00">
  74 <input type="hidden" name="item_name" value="rEFInd Boot Manager">
  75 <input type="hidden" name="bn" value="PP-DonationsBF:btn_donate_LG.gif:NonHostedGuest">
  76 <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
  77 <img alt="Donate with PayPal" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
  78 </form>
  79 </td>
  80
  81 <td>
  82 <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
  83 <input type="hidden" name="cmd" value="_donations">
  84 <input type="hidden" name="business" value="rodsmith@rodsbooks.com">
  85 <input type="hidden" name="lc" value="US">
  86 <input type="hidden" name="no_note" value="0">
  87 <input type="hidden" name="currency_code" value="USD">
  88 <input type="hidden" name="amount" value="10.00">
  89 <input type="hidden" name="item_name" value="rEFInd Boot Manager">
  90 <input type="hidden" name="bn" value="PP-DonationsBF:btn_donate_LG.gif:NonHostedGuest">
  91 <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
  92 <img alt="Donate with PayPal" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
  93 </form>
  94 </td>
  95
  96 <td>
  97 <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
  98 <input type="hidden" name="cmd" value="_donations">
  99 <input type="hidden" name="business" value="rodsmith@rodsbooks.com">
 100 <input type="hidden" name="lc" value="US">
 101 <input type="hidden" name="no_note" value="0">
 102 <input type="hidden" name="currency_code" value="USD">
 103 <input type="hidden" name="amount" value="20.00">
 104 <input type="hidden" name="item_name" value="rEFInd Boot Manager">
 105 <input type="hidden" name="bn" value="PP-DonationsBF:btn_donate_LG.gif:NonHostedGuest">
 106 <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
 107 <img alt="Donate with PayPal" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
 108 </form>
 109 </td>
 110
 111 <td>
 112 <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
 113 <input type="hidden" name="cmd" value="_donations">
 114 <input type="hidden" name="business" value="rodsmith@rodsbooks.com">
 115 <input type="hidden" name="lc" value="US">
 116 <input type="hidden" name="no_note" value="0">
 117 <input type="hidden" name="currency_code" value="USD">
 118 <input type="hidden" name="item_name" value="rEFInd Boot Manager">
 119 <input type="hidden" name="bn" value="PP-DonationsBF:btn_donate_LG.gif:NonHostedGuest">
 120 <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
 121 <img alt="Donate with PayPal" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
 122 </form>
 123 </td></tr>
 124 </table>
 125
 126 <hr />
 127
 128 <p>This page is part of the documentation for the rEFInd boot manager. If a Web search has brought you here, you may want to start at the <a href="index.html">main page.</a></p>
 129
 130 <hr />
 131
 132 <p>Apple's OS X 10.11 (aka <i>El Capitan</i>) includes a new feature, known as System Integrity Protection (SIP), aka "rootless" mode. To understand SIP, you should first know that Unix-like systems, including OS X, have traditionally provided a model of security in which ordinary users can read and write their own files (word processor documents, their own digital photos, etc.), but not system files (programs, system configuration files, etc.). This system security model has worked well for decades on traditional Unix systems, which have been administered by computer professionals and used by individuals with less experience. For administrative tasks, the <tt>root</tt> account is used; on Macs, this access is generally granted by the <tt>sudo</tt> command or by various GUI tools. Most Macs are single-user computers that are administered by their users. Such people often lack the knowledge of the professional system administrators who have traditionally managed Unix systems; but they must still perform system administration tasks such as installing new software and configuring network settings. OS X has always provided some measure of security by requiring users to enter their passwords before performing these dangerous tasks, and by providing GUI tools to help guide users through these tasks in a way that minimizes the risk of damage.</p>
 133
 134 <p>Apple has apparently decided that these safeguards are no longer sufficient. I won't try to speak for Apple or explain their motivations, but the result of Apple's decisions is SIP. With SIP active, as is the default, OS X limits your ability to perform some of these administrative tasks. You can still install and remove most third-party programs, configure your network, and so on; but some critical directories can no longer be written, even as <tt>root</tt>, and some utilities cannot be used in certain ways, even as <tt>root</tt>. These restrictions impact rEFInd because one of the affected tools, a command called <tt>bless</tt>, is required to tell the Mac to boot rEFInd rather than to boot OS X directly.</p>
 135
 136 <p>The end result of SIP is that rEFInd cannot be installed under OS X 10.11 in the way described on the <a href="installing.html">Installing rEFInd</a> page&mdash;at least, not without first booting into <a href="#recovery">Recovery mode,</a> in which SIP restrictions are ignored or <a href="#disable">disabling SIP.</a> This page covers these two options in more detail, as well as a third: <a href="#another">Using another OS</a> to install rEFInd.</p>
 137
 138 <a name="recovery">
 139 <h2>Using Recovery Mode</h2>
 140 </a>
 141
 142 <p>Unless you've deleted its partition, the Recovery HD partition should be present on your Mac as a way to perform emergency recovery operations. The nature of this tool means that SIP cannot be enabled, so you can install rEFInd from a boot to this partition. The trouble is that this installation is not a full-fledged OS X system, so you may have trouble using it if you're not comfortable with such a bare-bones environment. Nontheless, it is arguably the best way to install rEFInd on a Mac that runs OS X 10.11. To do so, follow these steps:</p>
 143
 144 <ol>
 145
 146 <li><a href="getting.html">Download the rEFInd binary <tt>.zip</tt> file</a> and unpack it. You can unpack it on your regular hard disk or on a USB flash drive. Pay attention to where it's located, though; you'll need to find it later. Pay attention to both the name of the volume and the <i>complete</i> path to the directory in which it's stored. (Your home directory is normally <tt>/Users/<tt class="variable">yourname</tt></tt>, where <tt class="variable">yourname</tt> is your username. Your Desktop is normally <tt>/Users/<tt class="variable">yourname</tt>/Desktop</tt>.</li>
 147
 148 <li>Reboot the computer.</li>
 149
 150 <li>At the startup chime, hold down the Option+R key combination. The computer should launch into the Recovery system. This is a very bare system, with only a window providing a way to launch a handful of utilities and a menu bar, as shown here:</li>
 151
 152     <br /><center><img src="recovery-mode.png" align="center" width="814"
 153     height="514" alt="To install rEFInd, you must launch the Terminal from
 154     the menu bar." border=2> </center><br />
 155
 156 <li>Select Utilities -&gt; Terminal from the menu bar. A Terminal window should open.</li>
 157
 158 <li>If you unpacked rEFInd on a USB flash drive, insert it and wait for its access light (if it has one) to stop blinking.</li>
 159
 160 <li>Increase the size of the Terminal a bit. (This just makes its output more legible, since the next step produces long lines.)</li>
 161
 162 <li>Type <tt class="userinput">df -h</tt> in the Terminal. This produces a list of partitions that are mounted. Locate the one on which you unpacked the rEFInd files. It will normally be <tt>/Volumes/<tt class="variable">Somename</tt></tt>, where <tt class="variable">Somename"</tt> is the volume's name.</li>
 163
 164 <li>In the Terminal, use <tt>cd</tt> to change to the directory where the rEFInd files you unpacked earlier are stored. For instance, on my MacBook, I would type <tt class="userinput">cd /Volumes/Macintosh\ HD/Users/rodsmith/Destkop/refind-0.9.3</tt>. Note that if any element of this path includes a space, you must either enclose the <i>entire path</i> in quotes or precede the space with a backslash (<tt>\</tt>), as in this example's <tt>Macintish\ HD</tt> volume name.</li>
 165
 166 <li>Type <tt class="userinput">ls</tt> to verify that <tt>refind-install</tt> is present in this directory.</li>
 167
 168 <li>Type <tt>./refind-install</tt> to run the installation script.</li> It should run normally, as described on the <a href="installing.html">Installing rEFInd</a> page. You can add options, if you like, as described on the Installing rEFInd page. Alternatively, you can perform a manual installation, also as described on that page.</li>
 169
 170 <li>Reboot.</li>
 171
 172 </ol>
 173
 174 <p>At this point, rEFInd should come up and enable you to boot into OS X and any other OS(es) that are already installed. You should not need to perform these steps again unless OS X re-installs its own boot loader or a subsequent OS installation overrides the default boot option. You can install an updated rEFInd and it should install correctly, provided you're installing it to the EFI System Partition (ESP). The <tt>refind-install</tt> script may complain about a failure, but because you're overwriting one rEFInd binary with another one, it should continue to boot.</p>
 175
 176 <a name="disable">
 177 <h2>Disabling SIP</h2>
 178 </a>
 179
 180 <p>Another option is to disable SIP for your regular boot. This is a viable option if you're an expert who needs regular access to tools with which SIP interferes, such as low-level disk utilities. Regular users should probably avoid this option unless the preceding procedure does not work&mdash;and in that case, you should disable SIP temporarily and then re-enable it when you've finished installing rEFInd.</p>
 181
 182 <p>To disable SIP, you must first boot into the Recovery HD, as in the previous procedure, and launch a Terminal window. Instead of locating and running the <tt>refind-instal</tt> script, though, you should type:</p>
 183
 184 <pre class="listing"># <tt class="userinput">csrutil disable</tt></pre>
 185
 186 <p>This command will disable SIP for all OSes that honor this setting. (In theory, multiple versions of OS X might be installed on a single computer, and all of them that support SIP should honor the SIP settings. To the best of my knowledge, no non-Apple OS honors SIP settings, although that could change.)</p>
 187
 188 <p>Once you've typed this command, you can reboot the computer. When you return to your regular OS X installation, SIP should be disabled and rEFInd should install normally, as described on the <a href="installing.html">Installing rEFInd</a> page. You will also be able to use disk partitioning tools like my <a href="http://www.rodsbooks.com/gdisk/">GPT fdisk,</a> write to directories that are normally off-limits, and so on. Note that disabling SIP does <i>not</i> disable normal Unix-style protections&mdash;you'll still need to use <tt>sudo</tt> (or enter your password in a GUI dialog box) to acquire <tt>root</tt> privileges to perform these system-administration tasks. You'll be no less safe with SIP disabled under OS X 10.11 than you would be with OS X 10.10 or earlier.</p>
 189
 190 <p>If you want to re-enable SIP, you can do so in exactly the way you disabled it, except that you should type <tt class="userinput">csrutil enable</tt> rather than <tt class="userinput">csrutil disable</tt> in the Recovery environment.</p>
 191
 192 <a name="another">
 193 <h2>Using Another OS</h2>
 194 </a>
 195
 196 <p>A final option for installing rEFInd on a Mac that runs with SIP enabled is to do the installation using another OS. This other OS could be an OS that's already installed or an emergency boot disk, such as an <a href="http://www.ubuntu.com">Ubuntu</a> installation/recovery system.</p>
 197
 198 <p>If you follow this path, you'll need to know something about how to boot and use your non-Apple OS. The options are quite varied, so I can't provide every detail; however, I do have a few tips:</p>
 199
 200 <ul>
 201
 202 <li>If you've already installed another OS but can't boot it because of an upgrade to OS X 10.11, you can use rEFInd on CD-R or USB flash drive to boot to your other OS. You can download images for both media from the <a href="getting.html">rEFInd downloads page.</a> Prepare a boot medium, insert it in your computer, reboot, and hold down the Option (or Alt) key. The Mac's built-in boot menu should appear, enabling you to boot rEFInd from the removable disk. It should then let you boot your already-installed OS, whereupon you can follow the <a href="installing.html">regular rEFInd installation instructions</a> for that OS.</li>
 203
 204 <li>It's imperative that your rEFInd installation occur in an <i>EFI-mode boot!</i> Many Windows installations on Macs, in particular, are done in BIOS/CSM/legacy mode, and so cannot be used for installing rEFInd. rEFInd can boot most Linux installations in EFI mode (as above), but if a BIOS-mode GRUB is installed, you might accidentally boot it. See the <a href="bootmode.html">What's Your Boot Mode?</a> page for information on how to determine your boot mode.</li>
 205
 206 <li>You can use many Linux distributions' installers to run a minimal Linux system that you can use for installing rEFInd. This can be a useful trick even if you don't intend to run Linux normally. An <a href="http://www.ubuntu.com">Ubuntu</a> image can be useful for this. You should insert the boot medium and hold down Option (or Alt) while booting to launch the installer, but be sure to pick the option to "try Ubuntu before installing" (or a similar option for other Linux distributions). You may need to install the <tt>efibootmgr</tt> package to install rEFInd. (Typing <tt class="userinput">sudo apt-get install efibootmgr</tt> should do this in Ubuntu.)</li>
 207
 208 </ul>
 209
 210 <p>I've tested this method of installing rEFInd on my MacBook Air, but I can't promise it will work on all Macs&mdash;or even on an identical Mac with a configuration that's different from mine. My preference is to install rEFInd under OS X on Macs, because Apple likes to do things differently from everybody else, and so a Mac's firmware might not react in the usual way to tools like <tt>efibootmgr</tt> in Linux or <tt>bcdedit</tt> in Windows.</p>
 211
 212 <a name="conclusion">
 213 <h2>Conclusion</h2>
 214 </a>
 215
 216 <p>Although the goal of increased security is a good one, SIP is causing problems for intermediate and advanced users. The good news is that the process to install rEFInd on a system that runs OS X 10.11, although more complex than it used to be, is not an impossible one. Furthermore, once you've done it, you shouldn't have to do it again for a while. (An update to OS X's boot loader is entirely possible, though. If nothing else, the next major OS X update may require re-installing rEFInd.)</p>
 217
 218 <p></p>
 219
 220 <p></p>
 221
 222 <hr />
 223
 224 <p>copyright &copy; 2015 by Roderick W. Smith</p>
 225
 226 <p>This document is licensed under the terms of the <a href="FDL-1.3.txt">GNU Free Documentation License (FDL), version 1.3.</a></p>
 227
 228 <p>If you have problems with or comments about this Web page, please e-mail me at <a href="mailto:rodsmith@rodsbooks.com">rodsmith@rodsbooks.com.</a> Thanks.</p>
 229
 230 <p><a href="index.html">Go to the main rEFInd page</a></p>
 231
 232 <p><a href="using.html">Learn how to use rEFInd</a></p>
 233
 234   <p><a href="http://www.rodsbooks.com/">Return</a> to my main Web page.</p>
 235 </body>
 236 </html>