Although possible to disable the feature, those steps are crazy complicated, and probably impossible for anyone who isn't a developer. (Apart from anything else, regular users should never be advised to disable SIP.)
@grishka Edit because I'm rate limited:
I've not seen anything that does executable validation for linux and actually works. Needs lots of kernel support. See the response from the old DigSig author: https://stackoverflow.com/questions/1732927/signed-executabl...
You can check binary signatures on disk (tripwire) but that is extremely tiresome to maintain and does not prevent straight loading of shellcode into memory.
More recently: https://lwn.net/Articles/733431/
Signed kernel modules is on its way though: https://www.kernel.org/doc/html/latest/admin-guide/module-si...
I guess that would be a place to start for implementing SIP...
/usr/bin/vim was installed by my package manager, but there's no guarentee the version I'm running matches the version that was installed. Now in debian there is a file which has a checksum of the version the package installed, but that's not checked on execution, nor is it itself signed (so the process that replaced vim could just as easilly replace the checksum, or the process that checks the checksum)
ChromeOS uses dm-verity to verify the root partition at runtime, similar to Mac OS's signed system volume.
I won't disable SIP and I'll avoid installing Google Chrome on my new Macs, if possible.