解决 Mac OS X 10.11 安装 sip 没有权限的问题

Posted 2020-07-05 冰水比水冰

在搭建 PYQT 的过程中我遇上了一个非常恶心的问题，在安装 sip 的时候编译源码之后的安装过程中一直提示我：Operation not permitted ，我甚至重装了系统也无济于事，最终通过查资料解决了问题。

安装 sip

下载 sip 源码包解压之后进入它的目录下：

python configure.py
sudo make
sudo make install

这时出现了一个很恶心的报错提示：

cp -f sip /System/Library/Frameworks/Python.framework/Versions/2.7/bin/sip
cp: /System/Library/Frameworks/Python.framework/Versions/2.7/bin/sip: Operation not permitted
make[1]: *** [install] Error 1
make: *** [install] Error 2

于是乎，我用 su 登录 Shell，在重复以上过程，无果。

之后，我又使用 brew install sip，报同样的错误。

然后我又进入 /System/Library/Frameworks/Python.framework 目录打算一探究竟：

试图修改它的权限，结果：

原因

经历了XCode编译器代码被注入的事件后，这次 Mac OS X El Capitan系统的升级，启用了更高的安全性保护机制：系统完整性保护System Integrity Protection (SIP)。简单来讲就是更加强制性的保护系统相关的文件夹。开发者不能直接操作相关的文件内容。

苹果官方给出的解释：

System Integrity Protection is a security technology in OS X El Capitan that’s designed to help prevent potentially malicious software from modifying protected files and folders on your Mac.
In OS X, the “root” user account previously had no permission restrictions and could access any system folder or application on your Mac. Software gained root-level access when you entered your administrator name and password to install it and could then modify or overwrite any system file or application.
System Integrity Protection restricts the root account and limits the actions that the root user can perform on protected parts of OS X.
Paths and applications protected by System Integrity Protection include:
/System
/usr
/bin
/sbin
Apps that are pre-installed with OS X
Paths and applications that third-party apps and installers can write to include:
/Applications
/Library
/usr/local
System Integrity Protection is designed to allow modifications of these protected parts only by processes that are signed by Apple and have special entitlements to write to system files, like Apple software updates and Apple installers.
Apps that you download from the Mac App Store already work with System Integrity Protection. Other third-party software that conflicts with System Integrity Protection might be set aside when you upgrade to OS X El Capitan.
System Integrity Protection also helps prevent software from changing your startup volume. To boot your Mac from a different volume, you can use the Startup Disk pane in System Preferences or you can hold down the Option key while you reboot, and select a volume from the list.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Risks are inherent in the use of the Internet. Contact the vendor for additional information. Other company and product names may be trademarks of their respective owners.
https://support.apple.com/en-us/HT204899

解决方案

其实解决方案就已经很简单了，既然是系统中有 SIP 的问题，那么我们把它关闭就好了：

1. 重启系统
2. 按住 Command + R 进入 Recoverary 模式
3. 点击 实用工具 > 终端
4. 输入 csrutil disable
5. 重启系统

这时我们再重新编译安装 sip 就没有任何问题了。