+<pre class="listing">showtools shell,memtest,gdisk,csr_rotate,apple_recovery,windows_recovery,mok_tool,about,shutdown,reboot,firmware
+csr_values 10,77</pre>
+
+ <img src="func_csr_rotate.png" align="right" width="48" height="48"
+ alt="The SIP rotation tool rotates through all the CSR values you set"
+ border=2 background="gray"/>
+
+<p>Once these options are set and you reboot into rEFInd, you should see a new shield icon, as shown at the right. When you select this tool, rEFInd identifies the next available CSR value from the list you specified and switches to that mode, rotating back to the start of the list once the end is reached. To confirm that the SIP mode has changed, rEFInd displays, for three seconds, a message identifying the new mode.</p>
+
+<p>Whether or not you've enabled these SIP features in <tt>refind.conf</tt>, rEFInd displays the current SIP status on its "About" page:</p>
+
+ <br /><center><img src="about.png" align="center" width="525"
+ height="559" alt="rEFInd presents a graphical menu for selecting your
+ boot OS." border=2> </center><br />
+
+<p>Note the line that reads "System Integrity Protection is disabled (0x77)." This line will be updated whenever you use the CSR rotation tool, so if you've specified a large number of values and have forgotten where you are in your rotation, you can use the About screen to figure it out.</p>
+
+<p>Both the summary on the About page and the CSR rotation tool depend on the presence of the <tt>csr-active-config</tt> NVRAM variable, which is where this information is stored. Thus, these features will not be present on older Macs that have not seen the presence of an OS X version that sets this variable. Likewise, you probably won't see the SIP summary in About or be able to set these values via <tt>csr_rotate</tt> and <tt>csr_values</tt> on a UEFI-based PC. (You could always create the variable on such a system in some other way, in which case rEFInd would let you adjust it, but it would have no effect on any OS except OS X.)</p>
+
+<p>I provide these features in rEFInd as a convenience for developers and other advanced users who have a legitimate need to adjust their SIP settings. Using rEFInd for this purpose is much faster than booting into the OS X Recovery system to make these adjustments. I discourage others from playing with these settings, since changing them inappropriately could cause problems; that's why they're not enabled by default.</p>
+
+<a name="conclusion">
+<h2>Conclusion</h2>
+</a>