Install csrutil or new recovery partion on High Sierra volume?

Solution 1:

Install rEFInd to your hidden EFI volume. You then can restart the Mac, hold down the option key to invoke the Startup Manager, select rEFInd and instruct rEFInd to enable/disable SIP.

Actually, this is the fastest way to disable SIP because you an also instruct rEFInd to immediately boot macOS after disabling SIP.

Since you currently can not disable SIP, you will have to install rEFInd by not following the installation instructions. For example, to install to the internal drive EFI volume, you would enter the following commands.

Note: The commands below may overwrite boot files if you already have Windows or Linux installed on your Mac.

cd ~/Downloads/refind-bin-0.11.4/
./refind-install --usedefault /dev/disk0s1 

You can also create a USB flash drive with rEFInd instead of installing to your internal drive.

You may need to add the following lines to the bottom of the refind.conf file.

csr_values 10,77
showtools csr_rotate, shell, gdisk, memtest, mok_tool, apple_recovery, windows_recovery, about, hidden_tags, reboot, exit, firmware, fwupdate