Setting a NVRAM variable in normal boot not permitted but allowed in recovery mode

Question

If memory serves me right then in Yosemite it was possible to set the NVRAM variable agc with nvram boot-args even in normal full boot mode.

This seems to have changed in later versions of the OS.

In Sierra this results in an error message:

sudo nvram boot-args="-v agc=0"
nvram: Error setting variable - 'boot-args': (iokit/common) general error

If I issue this command in recovery mode it is still accepted without error in 10.12.6.

In SingleUser is it is likewise rejected.

Was this changed from 10.10 to 10.12? Why? Why doesn't it work anymore in normal boot mode but still in recovery?

Any insight on the above is appreciated. But the single question I like to have an answer to is: how can I set this NVRAM variable in either normal boot mode or at least in SingleUser boot mode?

Answer 1

See this answer from @tubedogg.

It would appear that the change from 10.10 to 10.12 is another step toward including all important security aspects within System Integrity Protection (SIP), meaning that you can't change these things without first explicitly setting privileges. SIP applies to all users on a Mac, including admins and root.

I've just confirmed (because I'm reconfiguring a MacBook Pro with Sierra 10.12.6 just now) that:

• Setting boot-args="-v" in recovery mode will retain the setting in a normal boot mode.

• Disabling SIP using csrutil disable in recovery mode will allow you to set boot-args in a normal boot session. WARNING: You should not disable SIP unless you really need to - and you should already know how and why!

Again according to @tubedogg, you can also leave SIP enabled, but allow nvram changes from your normal boot session. This might be more appropriate for your needs. In the Terminal in recovery mode type csrutil enable --without nvram and then restart. I haven't tried this option personally, as it's not something I need right now.

I also haven't tried your agc=0 switch. It's not something I've come across, and it wasn't in a list of boot arguments I consulted, although I did manage to find a reference that appears to resolve a very specific GPU hardware problem. I see no real reason why you should not be able to set boot-args="-v agc=0" in the same scenarios I can set boot-args="-v".

Answer 2

In High-Sierra 10.13.6 on an Early 2011 Macbook Pro, I could clear-off the boot verbose mode nvram in normal boot mode itself. A reboot after that, booted without the logs.

RAJANANDPKsMBP:~ rajanandpk$ nvram boot-args
boot-args   -v agc=0
RAJANANDPKsMBP:~ rajanandpk$ sudo nvram boot-args=""
Password:
RAJANANDPKsMBP:~ rajanandpk$ nvram boot-args
boot-args   
RAJANANDPKsMBP:~ rajanandpk$ sudo nvram -d boot-args
RAJANANDPKsMBP:~ rajanandpk$ nvram boot-args
nvram: Error getting variable - 'boot-args': (iokit/common) data was not found