ios – Why my disabled SIP can’t bypass the entitlements verify?

I’m attempting to construct a neighborhood endpoint for log assortment utilizing the Endpoint Safety framework for analysis functions. Nevertheless, because of the agile nature of the challenge, I can not apply for the required entitlements.

In line with Apple’s documentation, disabling SIP (System Integrity Safety) ought to enable binaries to run with out entitlement checks. Nevertheless, after compiling my binary and working it on a macOS system with SIP disabled, I nonetheless encounter a “permission denied” error.

Listed here are the steps I’ve taken to date:

• Disabled SIP by booting into restoration mode and working csrutil disable.
• Verified SIP is disabled utilizing csrutil standing.
• wrote a demo

import Basis
import EndpointSecurity

var consumer: OpaquePointer?

// create consumer and catch message
let res = es_new_client(&consumer) { (consumer, message) in
    // messge course of
}

// print error code
print("Outcome code: (res)")

change res {
case ES_NEW_CLIENT_RESULT_SUCCESS:
    print("sucess")
case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED:
    print("error:lack of entitlement")
case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED:
    print("error: software doesn't have required system permissions")
case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED:
    print("error: root privileges required")
case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT:
    print("error: invalid argument")
case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS:
    print("error: most variety of shoppers reached")
case ES_NEW_CLIENT_RESULT_ERR_INTERNAL:
    print("error: inside error")
default:
    print("unknown error: (res)")
}
if res != ES_NEW_CLIENT_RESULT_SUCCESS {
    exit(EXIT_FAILURE)
}

and I get the output beneath

Outcome code: es_new_client_result_t(rawValue: 3)
error:lack of entitlement

I’d like to know:

• get my demo run?
• has SIP rule modified through the replace of macos15?