With SIP you can't change some things even as root. SIP has definitely made macos a harder target, though it is still lagging Windows in some areas. Linux is almost comically unprotected.

@grishka Edit because I'm rate limited:

I've not seen anything that does executable validation for linux and actually works. Needs lots of kernel support. See the response from the old DigSig author: https://stackoverflow.com/questions/1732927/signed-executabl...

You can check binary signatures on disk (tripwire) but that is extremely tiresome to maintain and does not prevent straight loading of shellcode into memory.

More recently: https://lwn.net/Articles/733431/

Signed kernel modules is on its way though: https://www.kernel.org/doc/html/latest/admin-guide/module-si...

I guess that would be a place to start for implementing SIP...