TotalFinder with System Integrity Protection

This page describes specific information for macOS 10.11 (El Capitan) only.
If you have more recent macOS version please refer to macOS 10.14 (Mojave) SIP instructions.

Starting with macOS 10.11 (El Capitan) Apple has introduced System Integrity Protection (SIP). This prevents TotalFinder to modify Finder.app.

This article describes how to configure your machine by partially disabling the new setting, so that you can run TotalFinder.

Before you do this, it is important to get informed about what System Integrity Protection is, and what it means to turn it off. Technical details are well covered in the El Capitan review on Ars Technica. Apple also provide some information here.

Anyway, if you decide to partially disable SIP, you will be able to install and run TotalFinder as before. Just to be clear…

I'm not encouraging you to modify your System Integrity Protection settings. Your machine may be less secure if you do. It is entirely your decision.

How to partially disable System Integrity Protection

You must boot into the Recovery OS. You do this by restarting your machine, and holding COMMAND + R until the Apple logo appears.

Then select Terminal from the Utilities menu. It looks like this:

In the window that opens, type csrutil enable --without debug and press return.

This turns off the part of SIP that TotalFinder needs to run, and OS X complains that it is an unsupported configuration.

Now type reboot and press return to restart your machine. After restart you may install the latest version of TotalFinder.

Technical details

TotalFinder works by modifying Finder.app. macOS does not provide any other way to achieve deep Finder modifications, we believe this is the only way the functionality of TotalFinder can be achieved.

In order to add or change some features of Finder, we use a technique called code injection. This means we add some additional code to the Finder program whilst it is running to do what we need. This is relatively safe - in fact we do not change any part of OS X on the disk. You only have to force quit Finder via COMMAND+OPTION+ESC to relaunch Finder.app cleanly and everything will be as if TotalFinder was never running.

However, System Integrity Protection measures disallow this kind of modification even if you have administrator access. In order for TotalFinder to launch, part of System Integrity Protection must be disabled.

You can find some further information in our blog.

Need to enable System Integrity Protection again?

Please follow this article.