Cannot remove GT8P3H7SPW.com.mcafee.CMF.networkextension service from launchd

Question

ref: Consent needed to enable ENSM Firewall 10.7.5 and later

This system extension was left over from a McAfee LiveSafe install that I had removed using the provided uninstaller.

I had to disable it from Network Settings to prevent the hard crashing that began to occur after installing another antivirus product. I eventually removed it completely with the - button.

system.log is flooded with these entries

Sep 29 19:54:25 macbroke com.apple.xpc.launchd[2] (GT8P3H7SPW.com.mcafee.CMF.networkextension): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

There were some mcafee entries left over in disabled.plist, so made sure to disable them

$ grep -rnw '/var/db/com.apple.xpc.launchd/' -e "mcafee"  
/var/db/com.apple.xpc.launchd//disabled.plist:7:    <key>com.mcafee.genutility</key>
/var/db/com.apple.xpc.launchd//disabled.plist:17:   <key>com.mcafee.datupdate</key>
/var/db/com.apple.xpc.launchd//disabled.plist:19:   <key>com.mcafee.virusscan.fmpd</key>
/var/db/com.apple.xpc.launchd//disabled.plist:21:   <key>com.mcafee.productupdate</key>

I was also able to successfully run disable on the network extension, though launchd continued to run it, according to system.log

sudo launchctl disable system/GT8P3H7SPW.com.mcafee.CMF.networkextension

$ launchctl print-disabled system  
disabled services = {
    "com.mcafee.genutility" => true
    "com.mcafee.datupdate" => true
    "com.mcafee.virusscan.fmpd" => true
    "com.mcafee.CMF.networkextensionn" => true
    "com.mcafee.productupdate" => true
    "GT8P3H7SPW.com.mcafee.CMF.networkextension" => true
}

I then attempted to remove the network extension, but was given a "not privileged" error

sudo launchctl remove GT8P3H7SPW.com.mcafee.CMF.networkextension

Sep 29 12:22:19 macbroke com.apple.xpc.launchd[2] (com.apple.xpc.launchd.domain.system): Caller not allowed to perform action: launchctl.642, action = service remove, code = 1: Operation not permitted, uid = 0, euid = 0, gid = 0, egid = 0, asid = 100007

unload gave an "Input/output error"

sudo launchctl unload system/GT8P3H7SPW.com.mcafee.CMF.networkextension

print revealed the location of the service module

launchctl print system/GT8P3H7SPW.com.mcafee.CMF.networkextension

program = /Library/SystemExtensions/D61ECA19-7AC8-43FF-98C0-A3FE84132C34/com.mcafee.CMF.networkexte
nsion.systemextension/Contents/MacOS/com.mcafee.CMF.networkextension

Would removing this file/directory cause launchd to stop trying to schedule it? I realize that the scheduling of a service is probably independent of its binaries existing or not, but figured it may be worth a try.

Even with sudo I do not have privileges to rename the parent directory under /Library/SystemExtensions, but could possibly from Recovery. However this would require mounting the primary partition which I think I had trouble with a while back when creating a manual image with hdiutil.

---

Opening embedded.provisionprofile with command ⌘-O

Previewing embedded.provisionprofile with space

Answer 1

That looks a lot like a Network Filter which I believe is a kind of System Extension. You should take a look at the output of systemextentionsctl list and construct a command similar to this:

systemextensionsctl uninstall CT8P3H7SPW com.mcafee.CMF.networkextension

Depending on your OS, you may need to first disable SIP by booting into recovery and running csrutil disable. Don't forget to re-enable it afterwards.