| layout | title | subtitle |
|---|---|---|
tf-doc |
TotalFinder on Apple Silicon (M1, M2, etc.) |
TotalFinder on Apple Silicon (M1, M2, etc.) |
While TotalFinder is compatible with Apple Silicon, this is not officially supported by BinaryAge.
If you are looking for help, please kindly refer to the discussion thread on the BinaryAge forums.
The instructions below will guide you through the steps required to use TotalFinder on your Apple Silicon machine.
Run csrutil status in a Terminal to verify your system's current SIP status.
If you see the output below (SIP enabled), then begin from Part 1.
System Integrity Protection status: enabled.
If you see the output below (SIP disabled), then begin from Part 3.
System Integrity Protection status: disabled.
If you see the output below (SIP partially weakened), then begin from Part 3, and keep reading to find out what SIP flags TotalFinder requires you to set in recoveryOS.
System Integrity Protection status: unknown (Custom Configuration).
Your machine may be less secure when you disable these security features. It is entirely your decision whether or not to modify these settings.
If you've already placed your Mac in "Reduced Security" mode before, simply skip this section.
※ If you use kernel extensions (kexts) on your system, you are already in "Reduced Security" mode.
① Shut down your Apple Silicon machine.
② Press and hold down the power button until the text under the Apple logo says "Loading startup options…", then let go.
③ Select "Options".
④ You are now in recoveryOS — enter your password if it asks.
⑤ Go to Utilities → Startup Security Utility.
⑥ Select "Reduced Security" and enable "Allow user management of kernel extensions from identified developers".
⑦ Shut down your Apple Silicon machine.
※ TotalFinder does not actually use any kernel extensions for any part of its functionality. The only reason why we perform this step is because it is required in order for SIP to be correctly disabled. The reason why is not yet fully understood.
IMPORTANT: Disabling SIP in any capacity, even partially, will also disable Apple Pay, as well as iOS-on-macOS apps downloaded from the App Store (※ more on this below).
This is a strange (and annoying) decision that Apple has recently decided to make. It used to be the case that Apple Pay would actually work fine on T2 Mac hardware with SIP disabled… but that changed with the bridgeOS update shipped with macOS 13, which backported this previously Apple Silicon exclusive behaviour to T2 Macs, too.
※ iOS-on-macOS apps that were installed through other non-App Store means, such as via sideloading, third-party tools, or your own developed apps from Xcode will continue to function normally. The only iOS apps that will stop working are ones encrypted with Apple's FairPlay DRM — in other words, just those downloaded from the App Store.
① Follow steps 2〜4 from above.
② Go to Utilities → Terminal.
③ Type in the following to fully disable SIP: csrutil disable
④ Reboot your Apple Silicon machine.
① Run the following command in a Terminal session.
touch ~/.totalfinder-dontcheckarchitecture
※ If you have multiple users on your Apple Silicon machine that use TotalFinder, you will need to repeat just the touch command above for each user.
② Either run the following command in a Terminal session, or use Activity Monitor to force-quit TotalFinder.app and then open it again from /Applications.
killall TotalFinder; open /Applications/TotalFinder.app
Enjoy TotalFinder on your Apple Silicon machine!
(※ There may be a few on-screen dialogs from TotalFinder left for you to go through, but they should be relatively simple and straightforward.)
Is there a way to only disable just the parts of SIP that TotalFinder strictly needs? I want my system to be as secure as possible while still using TotalFinder!
※ Note: If you were directed to this page by TotalFinder from the NVRAM dialog shown on macOS 13 Ventura or above, this is the section you're looking for.
TotalFinder requires that you have at least CSR_ALLOW_TASK_FOR_PID (0x04, --without debug) and CSR_ALLOW_UNRESTRICTED_FS (0x02, --without fs) disabled.
CSR_ALLOW_UNRESTRICTED_NVRAM (0x40, --without nvram) is required only for Apple Silicon machines running macOS 13 Ventura or newer.
All other SIP features do not affect TotalFinder's functionality and can be in any state you want.
You can partially disable just the SIP flags mentioned above for TotalFinder operation using one of these csrutil invocations in recoveryOS.
csrutil enable --without debug --without fs --without nvram
※ Note: For macOS 12 and below, --without nvram is not actually required. It's just included here for the sake of simplicity.
csrutil enable --without debug --without fs
※ Using unsigned or ad-hoc signed kexts? If so, you will need to add --without kext to your csrutil invocation. (CSR_ALLOW_UNAPPROVED_KEXTS (0x200))
※ Do you use other software that requires SIP to be disabled? The vast majority of software that requires SIP to be disabled only really require the same two features as TotalFinder to be disabled. However, in some uncommon cases, you may have to disable additional SIP features. If something you use starts asking you to "disable SIP" after running the above csrutil invocation, please refer to the documentation and/or support of the software in question for more information.
※ Note: Please note that a partially-enabled SIP configuration is considered "unsupported" by Apple. Apple only supports an SIP-fully-disabled configuration.
That being said, many people including myself (Karen) have been running a partially-enabled SIP configuration for many years without any issues. The choice is entirely up to you.
TotalFinder supports automatically enabling arm64e ABI support for you with just one button press.
However, if you would prefer to do it manually, here are the instructions on how to do so.
① Run the following command in a Terminal session to see if you have any boot-args already set.
nvram boot-args
② Run the following command to enable arm64e ABI support. Make sure that you add in your own pre-existing boot-args, if you have any set!
It will ask you for your password — it is normal to not be able to see it as you type.
sudo nvram boot-args="-arm64e_preview_abi"
③ Reboot your system for the changes to take effect.
① Run the following command in a Terminal session.
rm ~/.totalfinder-dontcheckarchitecture
※ If you have multiple users on your Apple Silicon machine that use TotalFinder, you will need to repeat just the rm command above for each user.
② Follow steps 2〜4 from the first section above.
③ If you are certain that you switched your Apple Silicon machine to "Reduced Security" mode solely just for TotalFinder, go ahead and enable "Full Security" mode. This will also re-enable SIP.
However, if you use (or think you use) other applications on your Mac that use kernel extensions (kexts), run the following command in a Terminal session to re-enable SIP while keeping "Reduced Security" mode.
csrutil enable
④ Run csrutil status in a Terminal to verify that SIP has been re-enabled. The output should resemble something like what's shown below:
-bash-3.2# csrutil status System Integrity Protection status: enabled.
⑤ Reboot your Apple Silicon machine.