What El Capitan security feature is also called rootless?

System Integrity Protection is the macOS security feature also called “rootless.” It was introduced in OS X El Capitan in 2015 to restrict changes to protected system files and processes.

SIP limits even the root user, traditionally the highest-privilege account on Unix-like systems. It protects locations such as /System, /bin, /sbin, and much of /usr, while also restricting code injection and certain kernel-extension behavior.

A common mix-up is Gatekeeper, which checks whether applications are from identified developers or notarized sources. Secure Boot protects the startup chain, while SIP protects macOS after the system is running. SIP can be managed with Apple’s csrutil utility from macOS Recovery.