5

I have recently heard that a feature called rootless that is going to be on El Capitan. This means that folders such as /System cannot be modified by the root user and only signed kext (kernel extensions) can be installed on the computer.

I have not thought about it before but now I have I would like to make my own kext extensions. The only issue is I am not a paid developer so therefor I cannot sign my kext extensions.

When I upgrade to El Capitan would I be able to make by own kexts and install them on my system while still being able to boot my computer and not having to join the $99/Year Apple Developers Program?

Improve this question
1
  • -1 for now - the restrictions on signed kext needs a citation and what are you really trying to do? Is this about how you intend to distribute a kext or just putz with extensions on your development or text rig?
    – bmike ♦
    Oct 6, 2015 at 15:25

3 Answers 3

Reset to default
3

Rootless can be completely disabled on OS X El Capitan (though not on iOS, for hopefully obvious reasons). Therefore if you don't mind foregoing the ostensible benefits it provides, you can essentially revert to Yosemite's security model - which is to say, unsigned kexts can be used, but it requires preparation to do so.

It may not be able to be disabled in future versions of the OS, but for now it can be turned off.

Improve this answer
8
  • 1
    So I just disable it using the command sudo nvram boot-args="rootless=0";sudo reboot? Would this compromise my security or not? How necessary is this rootless feature?
    – iProgram
    Jun 15, 2015 at 13:20
  • It's not whether disabling Rootless comprises security outright; it's whether the trade offs are worth it. If you don't open unknown email attachments or links, don't visit websites that are likely to try to install malware, only download and install trusted software, etc, it may not affect you. It's another layer of security that each user has to decide for himself if it is necessary in their particular set of circumstances.
    – tubedogg
    Jun 16, 2015 at 8:24
  • 1
    -1 It's not clear whether rootless will be optional, neither on El Capitan nor on any of the following versions.
    – Chris Harrington
    Jun 16, 2015 at 18:15
  • There's an entry in the Utilities menu when booting into Recovery (as I understand it) that lets you disable it. Ars has a screenshot of the dialog. Agreed there are no promises it won't become mandatory in the future, but it can be disabled in El Capitan.
    – tubedogg
    Jun 16, 2015 at 18:22
  • 1
    Let's be clear: it's optional only in a non-public pre-release. They've never committed to this workaround. They have no incentive to permit unsigned kexts; in fact, they only have a negative incentive.
    – Chris Harrington
    Jun 16, 2015 at 18:29
2

Reboot your machine in recovery mode : hold cmd+r

Then launch the terminal and deactivate the System Integrity Protection status by entering the following command line :

$ csrutil disable

This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.

But your unsigned kext will load

Improve this answer
1
  • It should read "disable", instead of "disbale".
    – Redarm
    Oct 9, 2015 at 12:10
0

Your computer will always be able to boot with or without unsigned kexts (well, that is, assuming they don't provide some boot critical function like a SATA driver for your boot disk). Whether your computer will still be useful after booting without an unsigned kext of course depends on the nature of the extension.

At WWDC 2013, there was a presentation about kext development that was very explicit: signing is supported and unchecked in 10.8, checked but not enforced in 10.9, and mandatory "in the future".

Signing requires a developer identity, and a developer identity requires an active Apple Developer Program membership.

So in answer to your question: No, you will not be able to develop and load kexts on upcoming versions of OS X without being an ADP member.

Apple has a section on their developer website dedicated to code signing topics.

Improve this answer
10
  • So you mean that there is no point in me learning how to make kexts then? Would I be able to boot into Single User Mode and delete the kext if I cannot use my computer since it can still boot?
    – iProgram
    Jun 13, 2015 at 17:36
  • I wouldn't say there's no point. For $99 a year, you could easily recoup your costs in terms of increased productivity or a marketable product.
    – Chris Harrington
    Jun 13, 2015 at 17:40
  • In terms of whether you could boot into Single User mode, I would say that it probably isn't required unless something about your kext is actually breaking your Mac. But to literally answer your question, yes; when you build a kext you have to specify how "critical" your kext is, and only certain levels of "critical" are loaded in Single User mode.
    – Chris Harrington
    Jun 13, 2015 at 17:41
  • Suppose it isn't too bad cost. I worked out (if I did my maths correctly) if I released an application today and charged $0.99 for it and got 1 download a day I would have got my $99 back by the 21st of September. Not bad really. Only issue is I am not very creative. Maybe I could copy some ones idea and edit bit since there are loads of knock-offs in the App Store. Would that be ok to do? Also with xCode 7 you can now test your application without being a developer. This would be a good way to test!
    – iProgram
    Jun 13, 2015 at 17:59
  • @iProgram Testing your application never required a Developer account on Mac, restrictions applied only for iOS
    – LaX
    Jun 13, 2015 at 18:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .