18

I'm trying to temporarily disable KEX signing enforcement on my MBP since my company's VPN client (GlobalProtect) is failing the signature check now. This started yesterday when I did the OS upgrade to Sierra yesterday.

The solution should be running this command:

sudo nvram boot-args=kext-dev-mode=1

The problem is that I am getting the following response, and I can't figure out what it means or what to do about it (meaning I can't connect to my company network, too).

nvram: Error setting variable - 'boot-args': (iokit/common) general error

Does anybody have any ideas of things I could try or otherwise look at to track down the problem?

Thanks.

Improve this question
3
  • 1
    According to support.apple.com/en-gb/HT206871 it looks like you need to be booted to Recovery to change that
    – Tetsujin
    Commented Oct 6, 2016 at 12:43
  • That was indeed what was necessary. If you would care to post an answer, I'd be happy to accept it. Sadly, the setting did not fix my VPN problem, but that's another thing entirely....
    – Michael Oryl
    Commented Oct 6, 2016 at 13:55
  • ah, OK - will do. I wasn't certain but it seemed relevant.
    – Tetsujin
    Commented Oct 6, 2016 at 13:57

4 Answers 4

Reset to default
9

According to Apple KB : Prepare your institution for iOS 10 and macOS Sierra

...you must use the nvram command to properly set boot-args NVRAM variable. Starting with macOS Sierra, you must be booted to the recovery partition to run this command.

Improve this answer
1
  • This did not work with my Sierra. However, the csrutil option below did!
    – eduncan911
    Commented Mar 20, 2018 at 9:28
9

The kext signing restriction was integrated into System Integrity Protection starting in El Capitan, and as a result the old disable flag no longer works. But there's a new way to do it: boot in recovery mode, and run the command csrutil enable --without kext. I haven't tested it, but my understanding is that this will turn off the kext requirements, while leaving the rest of SIP enabled. If that doesn't do it, try csrutil disable to turn SIP off entirely.

Improve this answer
3
3

I got the similar issue and resolved the with the help above solution.Thanks..

  1. Get into Recovery Mode by restarting and holding down ⌘+R until Apple logo appears.
  2. In the top menu click Utilities > Terminal.

  3. In the Terminal window type:

    csrutil enable --without kext

    and press Enter.

  4. Then restart the Mac.
Improve this answer
-3

You need to apply that when in recovery mode. Enter in Recovery mode and then apply the following in the terminal:

nvram boot-args="serverperfmode=1 ncl=262144"

Then, reboot. After rebooting, check the parameter on the terminal via nvram -p

Improve this answer
2
  • Both of these boot-args are related to network performance and have nothing to do with kext signing.
    – rgov
    Commented Mar 31, 2018 at 6:33
  • Is this not a duplicate of apple.stackexchange.com/a/256145/10389 ?
    – jhfrontz
    Commented Nov 14 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .