Apple - macOS System Integrity Protection Configuration

It is possible to add your own protected directory to SIP:

• Boot to Recovery Mode and disable SIP
• Reboot and create a directory structure.

• Flag the whole folder or single files or folders:

  sudo chflags restricted /example
  sudo chflags restricted /example/example.app
  sudo chflags restricted /example/subdir/file
  

  or a folder hierarchy:

  sudo chflags -R restricted /example
  

  If you want to exclude a subdir after using the -R option you have to remove the restricted flag there:

  sudo chflags norestricted /example/subdir
  

• Boot to Recovery Mode and enable SIP

Now the folders example, example.app and the file /example/subdir/file are protected. You still can add or remove files to/from /example/subdir.

---

The restricted flag has no effect if SIP is disabled - the usual POSIX/ACLs permissions apply. With SIP enabled the files/folders are protected.

---

It is also possible to add, remove or change SIP-protected files and directories via an installer package which is signed by Apple’s own certificate authority. Since a normal user /customer usually doesn't have access to this certificate authority, this possibility is eliminated.

---

An earlier version of this answer asserted that it is required to modify the file /System/Library/Sandbox/rootless.conf and add something like:

                                /example
                                /example/example.app
*                               /example/subdir
                                /example/subdir/file

This is wrong! Simply flagging a file or folder as restricted is sufficient to protect it.