Q I tried manually re-installing some software from my backup, which included a kernel extension needing to go in /System/Library/Extensions, but OS X 10.11 refused to allow that. Why, and what can I do to fix this?
A Kernel extensions, or KEXTs with the extension .kext, operate at the lowest level of any third-party software, and can cause greatest havoc. Prior to El Capitan, you could authenticate to allow them to be installed in that folder. However, El Capitan has introduced additional protection in the form of SIP, which prevents even authenticated admin users from tampering with certain folders, including that one.
There are two options: if the software has been updated for El Capitan, download that latest installer, as it should work around SIP’s restrictions. If you cannot, then the other location in which extensions can still be installed in /Library/Extensions, although not all work properly when installed there.
If you are really desperate to install the extension, you can turn SIP off in Recovery mode, install the extension, then turn it back on, as described here.
Be careful with extensions: a rogue KEXT can crash the kernel so hard that it cannot even post a kernel panic in its last gasp.
Updated from the original, which was first published in MacUser volume 28 issue 16, 2012.