1

I've created a kernel extension for macOS High Sierra.

When the kernel extension file loads in High Sierra the user has to allow it in the Security & Privacy preferences.

How can I verify that the user allowed my kernel extension to load properly? Is there any file in which user allowed kernel extension details are stored?

Improve this question
3
  • 1
    Don‘t you get an error back if your application uses the functionality provided by the kext but the kext is not installed/enabled?
    – nohillside ♦
    Commented May 3, 2018 at 10:02
  • yes..my application gives an error if kernel extension is not installed but i want to check before running my application is user allowed in Security & Privacy?
    – pratz
    Commented May 3, 2018 at 10:20
  • 1
    Isn‘t your application already running when you do the checking? If yes, why not call the kext and handle the error in a meaningful manner? Overall this looks more like a Software design question.
    – nohillside ♦
    Commented May 3, 2018 at 11:26

1 Answer 1

Reset to default
1

I found a related post on StackOverflow proper that shows, the information about approvals is stored in sqlite3 database at /var/db/SystemPolicyConfiguration/KextPolicy

If you can find your kext in the kext_policy table, then it has been approved. Here is an example:

sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy
SQLite version 3.19.3 2017-06-27 16:48:08
Enter ".help" for usage hints.
sqlite> select * from kext_policy;
...
4C6364ACXT|com.parallels.kext.hypervisor|1|Parallels International GmbH|1
4C6364ACXT|com.parallels.kext.vnic|1|Parallels International GmbH|1
4C6364ACXT|com.parallels.kext.netbridge|1|Parallels International GmbH|1
4C6364ACXT|com.parallels.kext.usbconnect|1|Parallels International GmbH|1
...
sqlite>

I needed this information in order to know why Parallels is suddenly asking for my approval again today, when as you can see it has clearly been granted already, but for my benefit the System Preferences isn't presenting me with any "Allow" button to grant it again. Perhaps Parallels is detecting that a new kext needs to be approved, but it seems Parallels hasn't actually tried to load it yet.

Unfortunately for me, since I was hoping I could remove the permission and get the "Allow" button back, the database is strictly read-only. The procedure for removing approvals involves booting with a recovery partition and sounds onerous. I guess I'll wait for Parallels support to answer via Twitter!

Credit for this answer goes to StackOverflow user @mikhail-iakhiaev https://stackoverflow.com/a/51684219/661659

(Edit: the issue was not with Parallels, my help desk admitted that our managed Mac workstations all got an update today that removed our ability to approve kexts as users. They hope to have it fixed by tomorrow, but for the benefit of your question, that's another avenue where your users might have ended up being stopped from approving your kexts as any other user would. Hope this helps!)

Improve this answer
3
  • I think opening /var/db/SystemPolicyConfiguration/KextPolicy database is allowed from mojave. /usr/bin/sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy command gives error Error: unable to open database "/var/db/SystemPolicyConfiguration/KextPolicy": unable to open database file
    – Amit Hooda
    Commented Feb 5, 2019 at 8:23
  • 1
    @AmitHooda "sudo /usr/bin/sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy" – still works on Mojave. Bear in mind that this is read-only, and you can only change the file with the somewhat onerous steps to put the system into recovery mode. The last word from me should have been that the broken software was because of a policy change from my organization's desktop support services team. They had to add the parallels kext to a central policy, and several other tools I heard about.
    – Kingdon
    Commented Feb 6, 2019 at 13:14
  • thanks for the response. Kind of figured out that sudo works. Yes we can only make changes in recovery mode that too by disabling csrutil disable and then reboot and then remove the entry from the KextPolicy database.
    – Amit Hooda
    Commented Feb 6, 2019 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .