In fact, I believe they are doing exactly this in El Capitan. Under the umbrella of "Rootless", you will no longer be able to arbitrarily modify [1] some specia

In fact, I believe they are doing exactly this in El Capitan. Under the umbrella of "Rootless", you will no longer be able to arbitrarily modify [1] some special blessed OS processes, like Finder.app. Some discussion of the politics of this issue: http://atp.fm/episodes/128 http://atp.fm/episodes/128 [1] haven't read enough to know the exact mechanism, but presumably restricting some forms of IPC like Mach messages?