El Capitan’s “System Integrity Protection” is an attempt to limit the damage an attacker can do. SIP places kernel-level checks on roots privilege that can (in theory, until proven otherwise) only be bypassed by the kernel itself. It’s not easy to disable SIP if you want to do it, but most users should just leave it off on their Macs. The SIP’s intention is to keep the operating system’s state as it was installed by Apple.”]
Source: https://arstechnica.com/gadgets/2015/09/os-x-10-11-el-capitan-the-ars-technica-review/8/