2

I'd like my shell script to verify if the /System/Library/Extensions folder (and subfolders) contains any kexts that don't pass signature validation. How do I do that?

There are a couple utilities that seem to include that kind of functionality, e.g.

kextcache -system-prelinked-kernel

but they either apply modifications to the system or do other unwanted lenghty checks. Only the signature validation is necessary here.

Many thanks in advance for your help!

Improve this question

1 Answer 1

Reset to default
3

Here's the script which will output not singed kexts inside this directory:

#!/bin/bash                                                                                                                                                                                                        

cd /System/Library/Extensions

find *.kext -prune -type d | while read d; do
    codesign -d "$d" 2>/dev/null
    rc=$?
    if [[ $rc != 0 ]] ; then
        echo "$d" is not signed.
    fi
done
Improve this answer
4
  • 1
    Thanks! I've however changed "find *" to find "find *.kext" in order to skip the signature checking of folders, and do kexts only.
    – DavidD
    Commented Nov 7, 2014 at 13:28
  • @DavidD Good point! I'll add it to an answer.
    – Mateusz Szlosek
    Commented Nov 7, 2014 at 13:29
  • 1
    Oops: I noticed that the code above actually only outputs files that have no signature at all. For those looking to output files that were signed, but got modified and therefore don't pass validation, modify the code above: 1) use 'codesign -v "$d" 2>&1 | grep "invalid signature"' 2) remove the rc variable and if statement
    – DavidD
    Commented Nov 8, 2014 at 9:02
  • Use find \*.kext.... you want to make sure the * gets through to to the find utility. Without it bash will do the expansion and that's not what you wanted.
    – Chris Cogdon
    Commented Sep 19, 2016 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .