Local policy error when disabling SIP on Big Sur/M1

I'm trying to disable System Integrity Protection on an M1 Mac.

csrutil disable as well as csrutil authenticated-root disable fail with an error:

csrutil: Failed to update security configuration for "Macintosh HD": Failed to create local policy

How can I avoid this failure? What is causing it?


This a brand-new Big Sur 11.0 (20A2411) on M1 MBP. FileVault is off. I'm booting into the new "Options" mode, and launching Terminal from there. Authentication is certainly OK, as I get a different error if I enter a wrong password. The user partition is accessible in this mode, I can write to /Volumes/Macintosh HD/Users/me/ for example.

-bash-3.2# csrutil disable
Turning off System Integrity Protection requires modifying system security.
Allow booting unsigned operating systems and any kernel extensions for OS "Macintosh HD"? [y/n]: y

Enter password for user admin: 
Mounted /dev/disk3s3 at <private>
Unmounted /dev/disk3s3 ( <private> )
csrutil: Failed to update security configuration for "Macintosh HD": Failed to create local policy

I had the same problem. This worked for me.

  1. csrutil clear
  2. Restart and return to the recovery terminal
  3. csrutil disable