From 7efb0ec3e15f37f9c5e12845aeccd9cd8693c01d Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <peter@eisentraut.org>
Date: Mon, 1 Mar 2021 07:58:17 +0100
Subject: [PATCH] doc: Update information on macOS SIP

On more recent versions of macOS, it is sufficient to disable only a
part of SIP in order to get make check to run before make install.
Document how.
---
 doc/src/sgml/installation.sgml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml
index 66ad4ba938..39adf1f5d9 100644
--- a/doc/src/sgml/installation.sgml
+++ b/doc/src/sgml/installation.sgml
@@ -2375,6 +2375,9 @@ <title>macOS</title>
     You may or may not wish to also install Xcode.
    </para>
 
+   <sect3 id="installation-notes-macos-sysroot">
+    <title>Sysroot</title>
+    
    <para>
     On recent <productname>macOS</productname> releases, it's necessary to
     embed the <quote>sysroot</quote> path in the include switches used to
@@ -2419,6 +2422,10 @@ <title>macOS</title>
     to build with a non-Apple compiler, but beware that that case is not
     tested or supported by the PostgreSQL developers.
    </para>
+   </sect3>
+
+   <sect3 id="installation-notes-macos-sip">
+    <title>System Integrity Protection</title>
 
    <para>
     <productname>macOS</productname>'s <quote>System Integrity
@@ -2429,6 +2436,25 @@ <title>macOS</title>
     install</literal> before <literal>make check</literal>.
     Most PostgreSQL developers just turn off SIP, though.
    </para>
+
+   <para>
+    To disable SIP, boot into recovery mode, open a terminal, and run
+<programlisting>
+csrutil disable
+</programlisting>
+   and reboot.  In macOS version 10.14 and later, it is sufficient to disable
+   the <quote>Debugging</quote> part of SIP, by running
+<programlisting>
+csrutil enable --without debug
+</programlisting>
+    instead.  The status of SIP can be shown using
+<programlisting>
+csrutil status
+</programlisting>
+    Note that that status display does not reflect changes until after a
+    reboot.
+   </para>
+   </sect3>
   </sect2>
 
   <sect2 id="installation-notes-mingw">
-- 
2.30.1