upvote
If you're going to insist on being one of those hardcore "I must be root" people then there's nothing I can say that will satisfy your urge. The same if you are one of those permanent Apple bashers.

However, for the benefit of more sensible people, I will point out:

    1. I used the terminology "layered security" twice in my post above
    2. By definition if you have a blind hatred of Apple SIP, you must also have a hatred of SELinux or AppArmor or dm-verity or kernel lockdown mode  on Linux.
reply
Does Apple SIP allow you to change the configuration per app? I thought now, which is a big difference with SELinux or Apparmor.
reply
AFAIK, no. SIP is for the whole system, period.

I think we could say AppArmor is more akin to TCC on macOS, though AppArmor would be much more flexible.

reply