Has anyone tried to use codesign to self-sign a previously-unsigned kext for personal use under Yosemite (10.10)? Self-signing is discussed in this apple technote, but not for kernel extensions specifically.

In my case, I have an unsigned kext that I'm willing to trust, but I also like the idea of the safety net only loading signed kexts provides in the general case. I'd rather specifically allow this one that I trust rather than just turn off verification wholesale with the dev mode boot option.

ALTERNATIVELY

Does anybody know where the trusted CA certificate(s) are stored for the kernel? Creating one's own CA and installing that in the kernel's cert db would be another way to accomplish the same thing. I could then sign that kext myself.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.