class ChefConfig::PathHelper

def self.is_sip_path?(path, node)

Determine if the given path is protected by macOS System Integrity Protection. 
def self.is_sip_path?(path, node)
  if node["platform"] == "mac_os_x" && Gem::Version.new(node["platform_version"]) >= Gem::Version.new("10.11")
    # @todo: parse rootless.conf for this?
    sip_paths = [
      "/System", "/bin", "/sbin", "/usr"
    ]
    sip_paths.each do |sip_path|
      ChefConfig.logger.info("This is a SIP path, checking if it in exceptions list.")
      return true if path.start_with?(sip_path)
    end
    false
  else
    false
  end
end