Skip to main content

Disable Security Features to Dual Boot OS X - El Capitan

So, I've recently been working on updating/rebuilding my latest little friend (an 11" MacBook Air) to dual boot the latest OS X, El Capitan, and Kali. I'll go over everything in full detail as soon as I can finish the setup, but I wanted to get this out there for anyone else that may stumble upon any issues with setting up rEFInd on an updated mac.

To start, while on Yosemite, I downloaded El Capitan from the App Store, and copied the install files to a USB. From there I preformed my upgrade. This might not be a good option for some people, as I'm sure your mac might be your primary computer... For me, that's not a problem. I tend to keep my essentials on USB drives / cloud storage as I tend to need access from different devices (phone, computer, tablet, etc.).

After preforming a clean install of El Capitan, I headed over to the rEFInd website, download the program and ran the install.sh script... Now, that appears to work, like it did with pervious versions of OS X. However, on reboot...no joy... So, I started down the path to see what went wrong. I go though the manual steps (I won't detail them here because the folks at rEFInd do a good job with that), and I find that everything appears to be as it should be.

Now, the final step in the manual install says to issue the "bless" command. When I attempted to issue the "bless" command, the terminal promptly responded with "bless failed"... Super....

A quick Google took me over to a thread on GitHub where this same issue was seen on BootChamp (see below for the reference). In that thread, I find this little nugget of information pulled form Apple's website:
Note: To safeguard against disabling System Integrity Protection by modifying security configuration from another OS, the startup disk can no longer be set programmatically, such as by invoking the bless(8) command.
After reading though everything, I had my plan of attack:

  1. Boot to recovery using the USB install disk that I created prior to the upgrade (like I said, I like to start fresh)
  2. Pull open the terminal while in recovery mode
  3. Enter the following command
csrutil disable


Now, for some pics for those that may get lost at this point:

Terminal in recovery with command ready to go


From here, I restarted the machine, then finalized the install of rEFInd using the "bless" command (again, detailed in the Manual Install instructions from their website). After that finishes successfully, I run another restart and viola! I'm in business:



References:

rEFInd:
http://www.rodsbooks.com/refind/

GitHub BootChamp Reference:
https://github.com/kainjow/BootChamp/issues/19

Apple's System Integrity Protection:
https://developer.apple.com/library/prerelease/mac/documentation/Security/Conceptual/System_Integrity_Protection_Guide/ConfiguringSystemIntegrityProtection/ConfiguringSystemIntegrityProtection.html
Labels:

Comments

Post a Comment

Popular posts from this blog

PowerShell Scripting: Low Disk Space Notification

Update 20150812 You'll see in the below comments that I left a global variable that was not required in the original script. The below post has been updated with that variable removed. Original Post So, I came across a need to have a script that checks the free space of a hard drive, calculates the percentage and send an e-mail notification of the free space is less than 10%. I figured that this could be scripted with PowerShell and run as a scheduled task in Windows. One thing I did find out is that I needed to create a service account in Active Directory with Server Admin permissions. Once you have that account in place simply copy the script below and name it "WhatYouWant.ps1" and set your Windows task accordingly. Disclaimer: I did reach out for assistance with creating this script on StackOverflow. My original script was writing the output to a text file, and copying the contents of that text file into the e-mail notification. This was not acceptable for the long...
5 comments
Read more

PowerShell Scripting: Removing Multiple Directories

Update 20150916 So the pic I used to display the CSV sample went missing. So the latest update just includes a text version of what was displayed. Thanks! Original Post I'm still fairly new to utilizing PowerShell to automate tasks and get big tasks done. But every time I use it, the tool makes my life a whole lot easier. Recently I was tasked with deleting over 500 directories. Thankfully someone else had the task of identifying the directories that were slated to be deleted, I just had to complete the process of removing them. Thanks to a little article from the Scripting Guy! Blog (found HERE ) I had some direction to start in. What I ended up doing is creating a single column CSV file that contains the path to the directories to be deleted. This path includes drive letter, and the overall path to the folder. It should look similar to this: delete C:\Path\to\folder C:\Path\to\folder2 D:\Path\to\folder D:\Path\to\folder2 I named the file "delete.csv" and pla...
2 comments
Read more

Using Python for GPG/PGP File Encryption - Part 1

So, this will be the start of a series that will build a python script for GPG/PGP file encryption. In this post, we'll look at installing gnupg for python and using python to setup the keystore, create a private key, exporting the associated public key, and importing a public key. Now everything done here can be done with simple gnupg commands, but learning how to do this with python will help in understanding the script we'll be building to complete file encryption. I will be covering non-python gnupg commands in a future post. Additionally, the folks at the python-gnupg site over at pythonhosted.org have done a really great job at documenting everything (link to their site at the bottom). The stuff I'll be going over will be more of a start-to-finish for anyone that may get lost in the muck of doing stuff with python. Full Disclosure #1: Any key identifier throughout the series of posts is FICTITIOUS and DOES NOT represent any real key, either associated with myself or...
1 comment
Read more