You do have to disable it, but you can patch the kernel to lie to userland about SIP status.