Can we override SIP protection with a symlink?

Solution 1:

Partial answer: If the symlinked file is one of the PressAndHold plists, it does not work.

With `…/Keyboard-en*.plist moved to a subdirectory, and copied to a non-SIP directory, I replaced what was moved-and-copied with symlinks to the copies. Press And Hold popups were no longer available. Removing the soft links and copying the originals back up restored the feature without even needing a log-out.

The copies linked were root:wheel with mode rw-r--r--, same as the originals. Changing the link modes to lrw-r--r-- did not restore the feature.

According to https://derflounder.wordpress.com/2015/10/01/system-integrity-protection-adding-another-layer-to-apples-security-model/ all directory trees protected by SIP are listed in /System/Library/Sandbox/rootless.conf which does NOT list /System/Library or /System/Library/Input\ Methods.  Nevertheless, the files I am currently wanting to work on are below /System/Library/Input\ Methods and are protected.