Using dtrace on MacOS with SIP enabled

The problem

On all current MacOS versions (Catalina 10.15.x, Big Sur 11.x) System Integrity Protection (SIP) is enabled by default and prevents most uses of dtrace and other tools and scripts based on it (i.e. dtruss).

The usual way to make dtrace work on MacOS is to boot into recovery mode and disable some of the SIP protections:

csrutil enable --without dtrace

However, this only works if you actually can boot into recovery mode — which isn’t the case if your Mac is in a remote place and you can only access it through some sort of software-based Remote Desktop (i.e. VNC, Apple Remote Desktop, Teamviewer, etc).

It’s also not possible (at least not via self-service to the best of my knowledge) to disable SIP on most Mac Cloud providers, like AWS EC2Flow Swiss or MacStadium. Same for Mac CI runners on services like GitHub Actions. (For AWS, support has confirmed that it’s not possible at all).

Read More

Tags: dtrace macOS