This system extension was left over from a McAfee LiveSafe install that I had removed using the provided uninstaller.
I had to disable it from Network Settings to prevent the hard crashing that began to occur after installing another antivirus product. I eventually removed it completely with the -
button.
system.log is flooded with these entries
Sep 29 19:54:25 macbroke com.apple.xpc.launchd[2] (GT8P3H7SPW.com.mcafee.CMF.networkextension): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
There were some mcafee entries left over in disabled.plist, so made sure to disable them:
$ grep -rnw '/var/db/com.apple.xpc.launchd/' -e "mcafee"
/var/db/com.apple.xpc.launchd//disabled.plist:7: <key>com.mcafee.genutility</key>
/var/db/com.apple.xpc.launchd//disabled.plist:17: <key>com.mcafee.datupdate</key>
/var/db/com.apple.xpc.launchd//disabled.plist:19: <key>com.mcafee.virusscan.fmpd</key>
/var/db/com.apple.xpc.launchd//disabled.plist:21: <key>com.mcafee.productupdate</key>
I was also able to successfully run disable
on the network extension, though launchd continued to run it, according to system.log
sudo launchctl disable system/GT8P3H7SPW.com.mcafee.CMF.networkextension
$ launchctl print-disabled system
disabled services = {
"com.mcafee.genutility" => true
"com.mcafee.datupdate" => true
"com.mcafee.virusscan.fmpd" => true
"com.mcafee.CMF.networkextensionn" => true
"com.mcafee.productupdate" => true
"GT8P3H7SPW.com.mcafee.CMF.networkextension" => true
}
I then attempted to remove
the network extension, but was given a "not privileged" error
sudo launchctl remove GT8P3H7SPW.com.mcafee.CMF.networkextension
Sep 29 12:22:19 macbroke com.apple.xpc.launchd[2] (com.apple.xpc.launchd.domain.system): Caller not allowed to perform action: launchctl.642, action = service remove, code = 1: Operation not permitted, uid = 0, euid = 0, gid = 0, egid = 0, asid = 100007
unload
gave an "Input/output error"
sudo launchctl unload system/GT8P3H7SPW.com.mcafee.CMF.networkextension
print
revealed the location of the service module
launchctl print system/GT8P3H7SPW.com.mcafee.CMF.networkextension
program = /Library/SystemExtensions/D61ECA19-7AC8-43FF-98C0-A3FE84132C34/com.mcafee.CMF.networkexte
nsion.systemextension/Contents/MacOS/com.mcafee.CMF.networkextension
Would removing this file/directory cause launchd to stop trying to schedule it? I realize that the scheduling of a service is probably independent of its binaries existing or not, but figured it may be worth a shot.
Even with sudo
I do not have privileges to rename the parent directory under /Library/SystemExtensions, but could possibly from Recovery. However this would require mounting the primary partition which I think I had trouble with a while back when doing manual image with hdiutil.
ref: Consent needed to enable ENSM Firewall 10.7.5 and later