1

ref: Consent needed to enable ENSM Firewall 10.7.5 and later

This system extension was left over from a McAfee LiveSafe install that I had removed using the provided uninstaller.

I had to disable it from Network Settings to prevent the hard crashing that began to occur after installing another antivirus product. I eventually removed it completely with the - button.

Doesn't like Bitdefender

system.log is flooded with these entries

Sep 29 19:54:25 macbroke com.apple.xpc.launchd[2] (GT8P3H7SPW.com.mcafee.CMF.networkextension): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

There were some mcafee entries left over in disabled.plist, so made sure to disable them

$ grep -rnw '/var/db/com.apple.xpc.launchd/' -e "mcafee"  
/var/db/com.apple.xpc.launchd//disabled.plist:7:    <key>com.mcafee.genutility</key>
/var/db/com.apple.xpc.launchd//disabled.plist:17:   <key>com.mcafee.datupdate</key>
/var/db/com.apple.xpc.launchd//disabled.plist:19:   <key>com.mcafee.virusscan.fmpd</key>
/var/db/com.apple.xpc.launchd//disabled.plist:21:   <key>com.mcafee.productupdate</key>

I was also able to successfully run disable on the network extension, though launchd continued to run it, according to system.log

sudo launchctl disable system/GT8P3H7SPW.com.mcafee.CMF.networkextension

$ launchctl print-disabled system  
disabled services = {
    "com.mcafee.genutility" => true
    "com.mcafee.datupdate" => true
    "com.mcafee.virusscan.fmpd" => true
    "com.mcafee.CMF.networkextensionn" => true
    "com.mcafee.productupdate" => true
    "GT8P3H7SPW.com.mcafee.CMF.networkextension" => true
}

I then attempted to remove the network extension, but was given a "not privileged" error

sudo launchctl remove GT8P3H7SPW.com.mcafee.CMF.networkextension

Sep 29 12:22:19 macbroke com.apple.xpc.launchd[2] (com.apple.xpc.launchd.domain.system): Caller not allowed to perform action: launchctl.642, action = service remove, code = 1: Operation not permitted, uid = 0, euid = 0, gid = 0, egid = 0, asid = 100007

unload gave an "Input/output error"

sudo launchctl unload system/GT8P3H7SPW.com.mcafee.CMF.networkextension

print revealed the location of the service module

launchctl print system/GT8P3H7SPW.com.mcafee.CMF.networkextension

program = /Library/SystemExtensions/D61ECA19-7AC8-43FF-98C0-A3FE84132C34/com.mcafee.CMF.networkexte
nsion.systemextension/Contents/MacOS/com.mcafee.CMF.networkextension

enter image description here

Would removing this file/directory cause launchd to stop trying to schedule it? I realize that the scheduling of a service is probably independent of its binaries existing or not, but figured it may be worth a try.

Even with sudo I do not have privileges to rename the parent directory under /Library/SystemExtensions, but could possibly from Recovery. However this would require mounting the primary partition which I think I had trouble with a while back when creating a manual image with hdiutil.


Opening embedded.provisionprofile with command ⌘-O

enter image description here

Previewing embedded.provisionprofile with space

enter image description here

2
  • Have you had a look at the output of systemextensionsctl list? systemextensionsctl uninstall might be able to deal with it.
    – chymb
    Sep 30 at 2:40
  • It did, after a quick csrutil disable in recovery. Please post this as an answer
    – samus
    Sep 30 at 3:03
1

That looks a lot like a Network Filter which I believe is a kind of System Extension. You should take a look at the output of systemextentionsctl list and construct a command similar to this:

systemextensionsctl uninstall CT8P3H7SPW com.mcafee.CMF.networkextension

Depending on your OS, you may need to first disable SIP by booting into recovery and running csrutil disable. Don't forget to re-enable it afterwards.

1
  • I'm now left wondering whether the launchctl commands would have ran successfully after disabling SIP. Regardless, Im betting thatsystemextentionsctl is cleaner. The man page only has a few lines.
    – samus
    Sep 30 at 3:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .