1

I'd like my shell script to verify if the /System/Library/Extensions folder (and subfolders) contains any kexts that don't pass signature validation. How do I do that?

There are a couple utilities that seem to include that kind of functionality, e.g.

kextcache -system-prelinked-kernel

but they either apply modifications to the system or do other unwanted lenghty checks. Only the signature validation is necessary here.

Many thanks in advance for your help!

2

Here's the script which will output not singed kexts inside this directory:

#!/bin/bash                                                                                                                                                                                                        

cd /System/Library/Extensions

find *.kext -prune -type d | while read d; do
    codesign -d "$d" 2>/dev/null
    rc=$?
    if [[ $rc != 0 ]] ; then
        echo "$d" is not signed.
    fi
done
  • 1
    Thanks! I've however changed "find *" to find "find *.kext" in order to skip the signature checking of folders, and do kexts only. – DavidD Nov 7 '14 at 13:28
  • @DavidD Good point! I'll add it to an answer. – Mateusz Szlosek Nov 7 '14 at 13:29
  • 1
    Oops: I noticed that the code above actually only outputs files that have no signature at all. For those looking to output files that were signed, but got modified and therefore don't pass validation, modify the code above: 1) use 'codesign -v "$d" 2>&1 | grep "invalid signature"' 2) remove the rc variable and if statement – DavidD Nov 8 '14 at 9:02
  • Use find \*.kext.... you want to make sure the * gets through to to the find utility. Without it bash will do the expansion and that's not what you wanted. – Chris Cogdon Sep 19 '16 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .