Allow building boxes with SIP disabled

[bacongravy]

Sometimes you need to test or verify something, and SIP gets in your way. It would be useful to be able to quickly spin up a VM with SIP pre-disabled.

The SIP setting is stored in NVRAM, so it may be possible to generate an appropriate .nvram file and drop it into the box at creation time, without having to boot the image at all.

[egandro]

I found this:

https://www.tekrevue.com/tip/mac-vm-boot-recovery-mode-vmware-fusion/

macosguest.forceRecoveryModeInstall = "TRUE"

Boots the VM in OSX Recovery Mode. This opens the door to an elevated terminal.

[egandro]

So this works. OSX gets into Recovery.

I have a theory - this might be the offset in the nvram that needs to be patched:

< 00002200: 0000 0000 2c3b 0000 61df e48b ca93 d211  ....,;..a.......
---
> 00002200: 0000 0000 463e 0000 61df e48b ca93 d211  ....F>..a.......

The other part I found is about the boot loader.

[KirkMartinez]

I have this need as well. Happy to test out any proposed implementations.
I tried hacking my nvram file, but replacing those bytes was not sufficient for "csrutil status" to show "disabled".

@egandro what did you find about the boot loader?

[egandro]

I put a few more hours in this investigating what the "magic bits" are in the NVRAM.

1. I created a fresh OSX install - backuped the nvram
2. I bootet into recovery (using the .vmx line for forcing the recovery mode) - i backuped the nvram
3. I csr'ed via recovery terminal - and i backuped the nvram

Binary diffing 1/2/3 lead into no insigths. I used diff + xxd (from vim - to create a hexdump)

So maybe somebody has a smarter idea then I have.

---

2nd approach - how does clover do this?

https://github.com/svn2github/cloverefiboot/blob/bb27dc5fc4c85f08375b04f3752d44fdf8c538fa/rEFIt_UEFI/Platform/kext_inject.c

They patch the kexts in memory :(

Unfortunately it's not a simulated nvram...

So this is still open...

[JonHolman]

Is there a way I can boot my macinbox virtualbox VM into recovery mode? I want to disable SIP to test some things. I see the line above, but I'm not sure where to put that.

[bacongravy]

@JonHolman Some quick googling indicates that there are a couple of methods that may work to get you into recovery mode with Virtualbox, but I don't have experience with them and can't comment on whether they would be effective.

The macosguest.forceRecoveryModeInstall = "TRUE" setting is for VMware Fusion, not Virtualbox, but I also haven't tested that method, either.

[JonHolman]

@bacongravy thanks. I'm not sure how to trigger booting into recovery mode with virtualbox, but I ended up creating a Mojave ISO and booted to that and was able to do what I wanted.

[egandro]

The macosguest.forceRecoveryModeInstall = "TRUE" setting is for VMware Fusion, not Virtualbox, but I also haven't tested that method, either.

This works - however - after doing that you can't get the system to boot into non recovery mode... Maybe I am to stupid.

[frankosterfeld]

https://github.com/myspaghetti/macos-virtualbox/blob/master/macos-guest-virtualbox.sh might have a solution for this (search for "csr-active-config"), generating a nvram file and loading it in the EFI boot loader, if I read that code correctly.

[frankosterfeld]

I've created a pull request, but I can only test virtualbox here, so this needs to be applied for the other providers, too.

[bacongravy]

@frankosterfeld Thank you for the PR! I haven't had a chance to give it a spin but it looks good. I don't how to replicate this functionality for VMware Fusion or Parallels Desktop, so it may need to be VirtualBox-only for now.

[bacongravy]

(Specifically, I don't know how to replicate the dmpstore call from startup.nsh for VMware or Parallels.)