Disabling System Integrity Protection

[ManasMahapatra]

I successfully set up The virtual machine with MacOS Mojave. However, for certain reasons, I need to disable the System Integrity Protection. Is there a way I can get into the recovery mode in the VM?
Host Machine: Ubuntu

[RicoVZ]

Hi contributors,

Thanks for the great setup script. It really helped.

Same issue/question here. I want to disable SIP.

To get into Recovery Mode, I re-attach the Base system VDI, boot into it, and disable SIP. However, after the restarting, Recovery mode is loaded again. It seems it will only boot into Recovery mode unless the Base system VDI is detached again.

The problem is that SIP is enabled again as soon as I boot into the OS, instead of Recovery mode.

I realize this might not be the best place to ask this question. 😅 Some tips/help to get us into the right direction would be greatly appreciated! 🙂

[myspaghetti]

You can create an NVRAM variable called csr-active-config and set it to 0x67, for example like so:

VBoxManage setextradata "${vmname}" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0002/Uuid" "7C436110-AB2A-4BBB-A880-FE41995C9F82"
VBoxManage setextradata "${vmname}" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0002/Name" "csr-active-config"
VBoxManage setextradata "${vmname}" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0002/Value" "bytes:$(echo -n '0x67' | xxd -r -p | base64)"

Please mind that I haven't tested this, and the csr-active-config variable might be stored elsewhere.

Additional interesting NVRAM variables found in this repository by erikberglund.

[RicoVZ]

We'll try that. Thanks for the response @myspaghetti. It is very much appreciated! 😄

[myspaghetti]

Tested, doesn't work. I recommend copying the value of csr-data from a genuine Mac with CSR disabled, that might work.

[myspaghetti]

@RicoVZ @ManasMahapatra the following disables CSR:

VBoxManage setextradata "${vmname}" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0003/Uuid" "7C436110-AB2A-4BBB-A880-FE41995C9F82"
VBoxManage setextradata "${vmname}" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0003/Name" "csr-active-config"
VBoxManage setextradata "${vmname}" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0003/Value" "bytes:$(echo -n '0x77' | xxd -r -p | base64)"

The csr-active-config value is 0x77 (in base16 encoded as base64). Make sure the EFI variable index is unique, for example if 0003 is already assigned, use 0004 and so on.

[ManasMahapatra]

Will try that. Thanks for all the help, @myspaghetti .

[mataps]

Hello guys, I found out that this works for windows. Haven't tested on other hosts.

VBoxManage setextradata "macOS" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0002/Uuid" "7C436110-AB2A-4BBB-A880-FE41995C9F82"
VBoxManage setextradata "macOS" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0002/Name" "csr-active-config"
VBoxManage setextradata "macOS" "VBoxInternal/Devices/efi/0/LUN#0/Config/Vars/0002/Value" "bytes:dwAAAA=="

[myspaghetti]

@mataps you don't need the extra three bytes after 0x77 (0x77 0x00 0x00 0x00). The NVRAM variable has been incorporated into the script.

[mataps]

@myspaghetti You're right, for some reason base64 didn't work for me during that time. So I went and used a web-based base64 encoder which added those extra bytes. I should use dw== instead, thanks @myspaghetti

[dvcrn]

I tried this on a Catalina install (macOS host) and it resulted in the VM giving me a "Can't attach Nvram Storage driver". Can anyone confirm that this method works on catalina?

/EDIT: This has worked for me to get me into recovery and disable SIP: geerlingguy/macos-virtualbox-vm#46 (comment)

[myspaghetti]

@dvcrn this is an old issue that doesn't apply to current versions. You can disable SIP as described in the documentation.

[crashbandicode]

Just leaving this to help anyone who may have run into issues following the documentation. Was small but basically after making the new ISO you need to mount it explicitly. When I rebooted after deleting the nvram etc it booted me into recovery for some reason. I restarted into macos picking the option without "base system" in the name. Then I logged in via ssh and mounted the iso using diskutils. After that I was able to follow the rest of the documentation and copy everything over to EFI. Everything is working now.