"System Integrity Protection applies limitations to all processes on the system, including privileged and unsandboxed ones. Certain system files, folders and processes are flagged for protection with an extended file attribute. Among the protected directories are: /System, /bin, /sbin, /usr (but not /usr/local).
The symbolic links from /etc, /tmp, and /var to /private/etc, /private/tmp, and /private/var are also protected, although the target directories are not themselves protected."

s.a. https://en.wikipedia.org/wiki/System_Integrity_Protection#Functions