class ChefConfig::PathHelper

def self.writable_sip_path?(path)

Determine if the given path is on the exception list for macOS System Integrity Protection. 
def self.writable_sip_path?(path)
  # todo: parse rootless.conf for this?
  sip_exceptions = [
    "/System/Library/Caches", "/System/Library/Extensions",
    "/System/Library/Speech", "/System/Library/User Template",
    "/usr/libexec/cups", "/usr/local", "/usr/share/man"
  ]
  sip_exceptions.each do |exception_path|
    return true if path.start_with?(exception_path)
  end
  ChefConfig.logger.error("Cannot write to a SIP path #{path} on macOS!")
  false
end