terminal

What does "csrutil" stand for?

The tool for managing the configuration of the System Integrity Protection / Rootless in the Terminal has the name csrutil.

[...]util stand for utility I would guess

But csr?

Solution

  • There was no manual page initially. In a following release (seen in Mohave for instance), there is a short manual page, which does not explain the utility's name:

    CSRUTIL(8)                BSD System Manager's Manual               CSRUTIL(8)

NAME 
     csrutil -- Configure system security policies

SYNOPSIS
     csrutil command [arguments ...]

DESCRIPTION
     csrutil modifies System Integrity Protection settings.  Some of the com-
     mands require the device to be booted into the Recovery OS.  Invoke
     csrutil with no arguments to see a full usage statement.

macOS                            June 15, 2017                           macOS

    It is part of the "System Integrity Protection" feature of El Capitan.

    Running strings on /usr/bin/csrutil shows things like

    Apple Code Signing Certification Authority
http://www.apple.com/certificateauthority

    "CSR" is a common abbreviation for certificate signing request, which seems to (mostly) fit with the observable details of the tool. In Apple-ese, "CSR" could mean certificate signature resource.

    A comment added (nearly 5 years after this answer) mentions "Configurable Security Restrictions". Searching for that finds an oblique mention in the patent realm:

    and the term itself is used in a comment in a system configuration file (which could be used by csrutil):

    # Configurable Security Restrictions
options     CONFIG_CSR              # <config_csr>

    Based on the dates alone, it's plausible to argue that this term is what was meant by the name "csrutil", but I've found nothing that proves it.

    The set of strings seen in the executable will change somewhat. Here are all of the matches with Catalina (the current release as of July 2020) containing any "config" (ignoring case):

    failed to retrieve system integrity configuration.
failed to store new configuration.
no configuration found.
Modify the System Integrity Protection configuration. All configuration changes
apply to the entire machine.
        Clear the existing configuration.
        Display the current configuration.
failed to clear system integrity configuration. This tool needs to be run as root.
failed to clear system integrity configuration. %s
requesting an unsupported configuration. This is likely to break in the future and leave your machine in an unknown state.
failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.
com.apple.security.csr-config
Custom Configuration
unknown (Custom Configuration).
Configuration:
This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.
csr-active-config

    The word "Configurable" is not in that executable.

    Perhaps they will provide documentation in the future to clarify it.

    Further reading: