4

I have recently heard that a feature called rootless that is going to be on El Capitan. This means that folders such as /System cannot be modified by the root user and only signed kext (kernel extensions) can be installed on the computer.

I have not thought about it before but now I have I would like to make my own kext extensions. The only issue is I am not a paid developer so therefor I cannot sign my kext extensions.

When I upgrade to El Capitan would I be able to make by own kexts and install them on my system while still being able to boot my computer and not having to join the $99/Year Apple Developers Program?

Some of the information contained in this post requires additional references. Please edit to add citations to reliable sources that support the assertions made here. Unsourced material may be disputed or deleted.

  • -1 for now - the restrictions on signed kext needs a citation and what are you really trying to do? Is this about how you intend to distribute a kext or just putz with extensions on your development or text rig? – bmike Oct 6 '15 at 15:25
3

Rootless can be completely disabled on OS X El Capitan (though not on iOS, for hopefully obvious reasons). Therefore if you don't mind foregoing the ostensible benefits it provides, you can essentially revert to Yosemite's security model - which is to say, unsigned kexts can be used, but it requires preparation to do so.

It may not be able to be disabled in future versions of the OS, but for now it can be turned off.

  • 1
    So I just disable it using the command sudo nvram boot-args="rootless=0";sudo reboot? Would this compromise my security or not? How necessary is this rootless feature? – iProgram Jun 15 '15 at 13:20
  • It's not whether disabling Rootless comprises security outright; it's whether the trade offs are worth it. If you don't open unknown email attachments or links, don't visit websites that are likely to try to install malware, only download and install trusted software, etc, it may not affect you. It's another layer of security that each user has to decide for himself if it is necessary in their particular set of circumstances. – tubedogg Jun 16 '15 at 8:24
  • 1
    -1 It's not clear whether rootless will be optional, neither on El Capitan nor on any of the following versions. – Chris Harrington Jun 16 '15 at 18:15
  • There's an entry in the Utilities menu when booting into Recovery (as I understand it) that lets you disable it. Ars has a screenshot of the dialog. Agreed there are no promises it won't become mandatory in the future, but it can be disabled in El Capitan. – tubedogg Jun 16 '15 at 18:22
  • 1
    Let's be clear: it's optional only in a non-public pre-release. They've never committed to this workaround. They have no incentive to permit unsigned kexts; in fact, they only have a negative incentive. – Chris Harrington Jun 16 '15 at 18:29
2

Reboot your machine in recovery mode : hold cmd+r

Then launch the terminal and deactivate the System Integrity Protection status by entering the following command line :

$ csrutil disable

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

But your unsigned kext will load

  • It should read "disable", instead of "disbale". – Redarm Oct 9 '15 at 12:10
0

Your computer will always be able to boot with or without unsigned kexts (well, that is, assuming they don't provide some boot critical function like a SATA driver for your boot disk). Whether your computer will still be useful after booting without an unsigned kext of course depends on the nature of the extension.

At WWDC 2013, there was a presentation about kext development that was very explicit: signing is supported and unchecked in 10.8, checked but not enforced in 10.9, and mandatory "in the future".

Signing requires a developer identity, and a developer identity requires an active Apple Developer Program membership.

So in answer to your question: No, you will not be able to develop and load kexts on upcoming versions of OS X without being an ADP member.

Apple has a section on their developer website dedicated to code signing topics.

  • So you mean that there is no point in me learning how to make kexts then? Would I be able to boot into Single User Mode and delete the kext if I cannot use my computer since it can still boot? – iProgram Jun 13 '15 at 17:36
  • I wouldn't say there's no point. For $99 a year, you could easily recoup your costs in terms of increased productivity or a marketable product. – Chris Harrington Jun 13 '15 at 17:40
  • In terms of whether you could boot into Single User mode, I would say that it probably isn't required unless something about your kext is actually breaking your Mac. But to literally answer your question, yes; when you build a kext you have to specify how "critical" your kext is, and only certain levels of "critical" are loaded in Single User mode. – Chris Harrington Jun 13 '15 at 17:41
  • Suppose it isn't too bad cost. I worked out (if I did my maths correctly) if I released an application today and charged $0.99 for it and got 1 download a day I would have got my $99 back by the 21st of September. Not bad really. Only issue is I am not very creative. Maybe I could copy some ones idea and edit bit since there are loads of knock-offs in the App Store. Would that be ok to do? Also with xCode 7 you can now test your application without being a developer. This would be a good way to test! – iProgram Jun 13 '15 at 17:59
  • @iProgram Testing your application never required a Developer account on Mac, restrictions applied only for iOS – LaX Jun 13 '15 at 18:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.