Alejandro Fanjul

One of the first things I usually do when I get a new macbook it’s to disable the SIP mechanism. In this case I’m trying to disable the SIP mode in my Macbook 16 M1 Pro. I consider myself an advance user so I can manage (and I need it) what apps and extensions do I want to install or use it. Apple is getting more and more restrictive, which is fine for average/newbie people, but not for advanced ones.

So as soon as I try to get into the recovery mode, I’ve got an error message saying «There are no users on this volume to recover«.  After asking for this issue in the apple discussions forum, nobody seems how to get rid of this error message and continue with the recovery mode.

Finally, reading and reading about all this topics, I read some guy in a forum saying that recoveryOs use the «bash» command line system, so I figured out that if I create a new user with «bash» command line shell instead of the default «zsh» I could get into the more and more hidden mode, and it worked!!

So now Im letting you the guide to be able to disabled SIP in Apple Silicon macs (and using Big Sur or Monterey)

1. First of all you need to create a new user with admin privileges, you can do it from the «users & groups» preference pane. Make sure to give him admin privileges
   
2.  After that, the most important part, you need to change their command line shell to «bash». So for that go and Right Click in their username (once created) to access to «Advanced Options«:
   
3. Ok, now we have an «admin» username with admin privileges and «bash» as his shell.
4. Next step is rebooting in recovery mode. So for that, the new Apple Silicon macs has changed its way to do it, now you have to shutdown your computer, press and hold the power button until it says «Loading startup Options», and then select «Options» and Continue.
5. This time, it will allow you to choose between your primary user and the one you have just created for this operation (so choose the new one, with «admin» username in my case).
6. No the fun part: I don’t know if this step is necessary, but for the sake of simplicity just do it, first you just have to enter into the «Startup Security Utility» to downgrade the security to «Reduced Security» (at this point, that is the only option -apart from full security- that it allows you to choose).
   
7. After confirm, close this utility, and launch the «Terminal» utility, and from there, just type the infamous: csrutil disable command.
   
8. And now, after a moment, the work is done! You can verify that its already done, going again into the «Startup Security Utility» to check that the new security is «Permisive«. I don’t know if that is exactly the same of disabling SIP, but it seems to be (you can check the different security policies here).
   

Now, after you reboot into normal mode, your great brand new Apple Silicon Macbook M1 has his SIP mechanism disabled at all. So you can remove your admin user, or even you can just keep it and hide it from the login screen using this command: sudo dscl . create /Users/username IsHidden 1

As an alternative to create a new username is just change your primary username shell. I deed I used to use «bash» instead of zsh in my previous macbook, but this time I will try to stick to the new zsh.