I have been searching a solution on how to disable the USB ports on Mac mini to prevent data copy to external USB mass storage devices. Precisely, my purpose is not to let Mac mini read/write data from/into USB devices.

According to this post ,kextunload command could be employed to accomplish this task in previous versions such as Sierra.

The problem that made me mad is there is only IOUSBMassStorageDriver.kext, but not IOUSBMassStorageClass.kext existing in /System/Library/Extensions/ directory. In addition, after running sudo kextunload -b com.apple.iokit.IOUSBMassStorageDriver, the below error keeps occurring.

(kernel) Can't remove kext com.apple.iokit.IOUSBMassStorageDriver; services failed to terminate - 0xdc008018.
Failed to unload com.apple.iokit.IOUSBMassStorageDriver - (libkern/kext) kext is in use or retained (cannot unload).

Anyone got any ideas? I really need help from this community.

  • This doesn't sound like the best idea, but regarding the kextunload issue, try unloading whatever kext is using IOUSBMassStorageDriver first. When I checked on my Mac (kextstat -b com.apple.iokit.IOUSBMassStorageDriver), AppleUSBTDM had a ref on it, if that's the only one for you as well, you might be able to unload it (if you don't plan on using target disk mode) then the mass storage kext. Not sure what the exact result would be though. Jan 30 '19 at 3:30
  • @user3052786 Thanks for your advice. The result of (kextstat -b com.apple.iokit.IOUSBMassStorageDriver) is only itself. That is to say no other devices have a ref on it. Do you have any other suggestions?
    – allenwang
    Jan 30 '19 at 4:56
  • com.apple.iokit.IOUSBMassStorageDriver is linked by com.apple.driver.AppleUSBTDM which is linked by com.apple.driver.AppleKeyStore. Unloading com.apple.driver.AppleKeyStore causes a kernel panic. Doesn't look like com.apple.iokit.IOUSBMassStorageDriver can be unloaded anymore. Jun 30 '19 at 2:10

Is it okay if the usb is recognized, but isn't mounted? When a drive is recognized but not mounted, and your SIP is enabled, system apps with the right entitlements might still be able to read/write directly to the disk, but most system and 3rd-party applications won't be able to write to the disk. If so, try disk arbitrator (download: https://github.com/aburgh/Disk-Arbitrator/releases). I'm sure most people know this already, but maybe someone will benefit from knowing this. I hope this helps.

  • Thanks for your answer. Do you know any solutions without the 3rd-party applications?
    – allenwang
    Feb 18 '19 at 2:25
  • You might be able to edit /etc/fstab to stop the automounting, but it doesn't work for me. You can run "man fstab" to read about it. Open /etc/fstab and add the following line: LABEL=(You Volume Name Here) or UUID=(Your Volume UUID here) (Your Volume Format) ro,noauto
    – Joy Jin
    Mar 7 '19 at 5:33
  • Editing /etc/fstab does not work for me, neither. It seems that only disk arbitrator can solve this problem, so I will accept your answer. Thank you so much!
    – allenwang
    Mar 12 '19 at 7:13
  • If you really don't want to have any software access the USB, there's another way: force mount devfs. Please do this at your own dispense: it may left your system unusable before a reboot, so save any unsaved works. Enter the following command: sudo umount -f /dev
    – Joy Jin
    May 13 '19 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .