I have requested an Endpoint Security entitlement through this form:https://developer.apple.com/contact/request/system-extension/How can I see that my request is done?How can I check that I am able to use this entitlement?Is it should be listed in my App ID Configuration Capabilities?
Post not yet marked as solved
Hi All,
I am trying to do a small POC using network extension's content filter capability. It is just a simple application for listening to all inbound connections on a particular port. I am able to build the application using Xcode. Through the main application i am able to install the network extension as system extension and I am able to view the installed extension in systemextensionctl list.
The problem is the I am not able to do anything after that , I don't think the extension is actually running. I am not able to see any logs in system.log. Few logs were present from devices log which indicate that the extension is running. The last log was
Request to activate com.sample.xyz.NetworkExtension succeeded (0).
Adding event subscription 930 for provider com.sample.xyz.NetworkExtension with extension point com.apple.networkextension.filter-data
I gave some debug logs and none of them were printed.
I have all entitlements in my provisional profile and if there was any code signing issue I guess it would have been present in system.log (atleast I assume)
Thanks in advance.
Post not yet marked as solved
Hello,
I'm keeping on getting a failure when trying to install an App from Samsung Dex. The report says to "disconnect your phone to install" but NO phone is connected. I tried various command line and numerous troubleshooting to reset and refresh some KEXT but still issue exists.
Here is the install.log below.
What could be the work around this bug?
How to reset and proceed with installation?
Thank you
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 16.0px 'Helvetica Neue'; color: #262626; -webkit-text-stroke: #262626; background-color: #ffffff}
span.s1 {font-kerning: none}
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: @(#)PROGRAM:Install PROJECT:Install-1000
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: @(#)PROGRAM:Installer PROJECT:Installer-1020
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Hardware: iMac18,2 @ 3.00 GHz (x 4), 32768 MB RAM
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Running OS Build: macOS 11.4 (20F71)
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: USER=KP
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: __CFBundleIdentifier=com.apple.installer
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: COMMAND_MODE=unix2003
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: LOGNAME=KP
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: PATH=/usr/bin:/bin:/usr/sbin:/sbin
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.LsIZhGSQv0/Listeners
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: SHELL=/bin/zsh
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: HOME=/Users/KP
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: __CF_USER_TEXT_ENCODING=0x1F5:0x0:0x0
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: TMPDIR=/var/folders/d_/hqzchb455m9ct55v66n3n2_w0000gn/T/
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: XPC_SERVICE_NAME=application.com.apple.installer.1152921500312163432.1152921500312163437
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Env: XPC_FLAGS=0x0
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Samsung DeX Installation Log
2021-07-08 19:33:08-04 KPs-iMac Installer[9137]: Opened from: /Volumes/Samsung DeX/Install Samsung DeX.pkg
2021-07-08 19:33:09-04 KPs-iMac Installer[9137]: Package Authoring Error: <background_scaling> has an unsupported MIME type: X-NSObject/NSNumber
2021-07-08 19:33:09-04 KPs-iMac Installer[9137]: Package Authoring Error: <background_alignment> has an unsupported MIME type: X-NSObject/NSNumber
2021-07-08 19:33:09-04 KPs-iMac Installer[9137]: Package Authoring Error: has an unsupported MIME type: X-NSObject/NSNumber
2021-07-08 19:33:09-04 KPs-iMac Installer[9137]: Failed to load specified background image
2021-07-08 19:33:09-04 KPs-iMac Installer[9137]: Product archive /Volumes/Samsung DeX/Install Samsung DeX.pkg trustLevel=350
2021-07-08 19:33:09-04 KPs-iMac Installer[9137]: External component packages (2) trustLevel=350
2021-07-08 19:33:09-04 KPs-iMac Installer[9137]: Could not load resource readme: (null)
2021-07-08 19:33:16-04 KPs-iMac Installer[9137]: Installation checks failed.
2021-07-08 19:33:16-04 KPs-iMac Installer[9137]: Installation check failure. . Disconnect your phone to install..
In another question on this forum (https://developer.apple.com/forums/thread/124775) eskimo stated that launching a system extension from an daemon is not the right approach and that the OSSystemExtensionRequest.activationRequest API should be called from an App.
My question is, does this same restriction apply to a LaunchAgent started App?
If so, to ensure activation as soon as possible is the only option to use a SMLoginItemSetEnabled helper to start the App on login?
Post marked as Apple Recommended
I built an app which hosts a CMIOExtension. The app works, and it can activate the extension. The extension loads in e.g. Photo Booth and shows the expected video (a white horizontal line which moves down the picture).
I have a couple of questions about this though.
The sample Camera Extension is built with a CMIOExtension dictionary with just one entry, CMIOExtensionMachServiceName which is $(TeamIdentifierPrefix)$(PRODUCT_BUNDLE_IDENTIFIER)
This Mach service name won't work though. When attempting to activate the extension, sysextd says that the extensions has an invalid mach service name or is not signed, the value must be prefixed with one of the App Groups in the entitlement.
So in order to get the sample extension to activate from my app, I have to change its CMIOExtensionMachServiceName to
<my team ID>.com.mycompany.my-app-group.<myextensionname>
Is this to be expected?
The template CMIOExtension generates its own video using a timer. My app is intended to capture video from a source, filter that video, then feed it to the CMIOExtension, somehow. The template creates an app group called "$(TeamIdentifierPrefix)com.example.app-group", which suggests that it might be possible to use XPC to send frames from the app to the extension.
However, I've been unable to do so. I've used
NSXPCConnection * connection = [[NSXPCConnection alloc] initWithMachServiceName:, using the CMIOExtensionMachServiceName with no options and with the NSXPCConnectionPrivileged option. I've tried NSXPCConnection * connection = [[NSXPCConnection alloc] initWithServiceName: using the extension's bundle identifier. In all cases when I send the first message I get an error in the remote object proxy's handler:
Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named <whatever name I try> was invalidated: failed at lookup with error 3 - No such process."
According to the "Daemons and Services Programming Guide" an XPC service should have a CFBundlePackageType of XPC!, but a CMIOExtension is of type SYSX. It can't be both.
Does the CMIOExtension loading apparatus cook up a synthetic name for the XPC service, and if so, what is it? If none, how is one expected to get pixel buffers into the camera extension?
Post not yet marked as solved
Hi!
I'm trying to move from CoreMedio I/O DAL Plug-In to CoreMedia I/O camera extensions, announced in macOS 12.3.
I created a test extension, placed it inside my app bundle into Contents/Library/SystemExtensions and signed with codesigning certificate. But when I try to install my extension from inside my app, using this code (Swift):
func requestActivation() {
guard case .idle = status
else { fatalError("Invalid state") }
print("Requesting activation of extension \"\(extensionIdentifier)\"")
let req = OSSystemExtensionRequest.activationRequest(forExtensionWithIdentifier: extensionIdentifier, queue: DispatchQueue.main)
req.delegate = self
OSSystemExtensionManager.shared.submitRequest(req)
status = .requested
}
I'm getting an error:
OSSystemExtensionErrorDomain error 8: Code Signature Invalid
which is rather generic. Can anybody tell me what I am doing wrong? Or at least propose some steps to find it out?
I'm posting here entitlements and codesign output for my extension and containing application for further information.
kdg@admins-Mac-mini SystemExtensions % codesign -d --entitlements - ./com.visicom.VirtualCamera.avextension.systemextension
Executable=/Applications/VirtualCamera.app/Contents/Library/SystemExtensions/com.visicom.VirtualCamera.avextension.systemextension/Contents/MacOS/com.visicom.VirtualCamera.avextension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
[Key] com.apple.security.application-groups
[Value]
[Array]
[String] 6SUWV7QQBJ.com.visicom.VirtualCamera
kdg@admins-Mac-mini /Applications % codesign -d --entitlements - ./VirtualCamera.app
Executable=/Applications/VirtualCamera.app/Contents/MacOS/VirtualCamera
[Dict]
[Key] com.apple.developer.system-extension.install
[Value]
[Bool] true
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
[Key] com.apple.security.application-groups
[Value]
[Array]
[String] 6SUWV7QQBJ.com.visicom.VirtualCamera
[Key] com.apple.security.files.user-selected.read-only
[Value]
[Bool] true
kdg@admins-Mac-mini SystemExtensions % codesign -dvvv ./com.visicom.VirtualCamera.avextension.systemextension
Executable=/Applications/VirtualCamera.app/Contents/Library/SystemExtensions/com.visicom.VirtualCamera.avextension.systemextension/Contents/MacOS/com.visicom.VirtualCamera.avextension
Identifier=com.visicom.VirtualCamera.avextension
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=1553 flags=0x10700(hard,kill,expires,runtime) hashes=37+7 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=25bd80657bfd6e0ab95467146c7b532817e9e520
CandidateCDHashFull sha256=25bd80657bfd6e0ab95467146c7b532817e9e5209fd50b0cb7ceef40dcfb40e8
Hash choices=sha256
CMSDigest=25bd80657bfd6e0ab95467146c7b532817e9e5209fd50b0cb7ceef40dcfb40e8
CMSDigestType=2
CDHash=25bd80657bfd6e0ab95467146c7b532817e9e520
Signature size=9006
Authority=Developer ID Application: Visicom Media Inc. (6SUWV7QQBJ)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=7 Jul 2022, 21:49:32
Info.plist entries=23
TeamIdentifier=6SUWV7QQBJ
Runtime Version=12.3.0
Sealed Resources version=2 rules=13 files=0
Internal requirements count=1 size=200
kdg@admins-Mac-mini /Applications % codesign -dvvv ./VirtualCamera.app
Executable=/Applications/VirtualCamera.app/Contents/MacOS/VirtualCamera
Identifier=com.visicom.VirtualCamera
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=1989 flags=0x10700(hard,kill,expires,runtime) hashes=51+7 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=31e15fbbd436a67a20c5b58c597d8a4796a67720
CandidateCDHashFull sha256=31e15fbbd436a67a20c5b58c597d8a4796a6772020308fb69f4ee80b4e32788b
Hash choices=sha256
CMSDigest=31e15fbbd436a67a20c5b58c597d8a4796a6772020308fb69f4ee80b4e32788b
CMSDigestType=2
CDHash=31e15fbbd436a67a20c5b58c597d8a4796a67720
Signature size=9006
Authority=Developer ID Application: Visicom Media Inc. (6SUWV7QQBJ)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=7 Jul 2022, 21:58:09
Info.plist entries=20
TeamIdentifier=6SUWV7QQBJ
Runtime Version=12.3.0
Sealed Resources version=2 rules=13 files=4
Internal requirements count=1 size=188
Thanks in advance!
Post not yet marked as solved
What happens when I try to run my app with the DNS proxy provider in network extension while another app with the same extension is already running? Will it throw an error?
Post not yet marked as solved
My application installs a system extension.
When I try to remove the app from the Applications folder (cmd + backspace) I get an error message:
"The operation can’t be completed right now because another operation is in progress, such as moving or copying an item or emptying the Bin."
According to systemextensionsctl the extension state is "terminating for uninstall but still running".
I can see an error in the console logs:
kernelmanagerd Failed to terminate dext com.my.driver-dk, error: Kernel request failed: (os/kern) invalid address (1)
sysextd a category delegate declined to terminate extension with identifier: com.my.driver-dk
sysextd failed to terminate extension with identifier: com.my.driver-dk: Optional(Error Domain=kernelmanagerd.KMError Code=38 "(null)")
Issue occurs with macOS 13 - works fine with macOS 12 and macOS 11
What is the problem here?
Have there been any changes in macOS in that regard?
I need to store auth keys somewhere, previously app network extension would store them in a shared keychain. Now we're trying to move to system extensions, for out of appstore distribution, and shared keychain will no longer work.
Is it possible to write to system keychain from system extension? If yes, how do I specify that I want to use system keychain?
Our current code returns errSecNotAvailable if run in System Extension instead of App Extension. The code looks like this. If uncommented, it will work from the App Extension.
NSString *teamID = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"Development Team"];
NSString *groupID = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"App Group ID"];
NSMutableDictionary *query = [NSMutableDictionary dictionaryWithDictionary:@{
(id)kSecClass: (id)kSecClassGenericPassword,
// (id)kSecAttrAccessGroup: [NSString stringWithFormat:@"%@.%@", teamID, groupID],
(id)kSecAttrService: groupID,
// (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
}];
[query setObject:(id)kCFBooleanTrue forKey:(id)kSecUseDataProtectionKeychain];
[query setObject:@(key) forKey:(id)kSecAttrAccount];
[query setObject:[NSData dataWithBytes:buffer length:length] forKey:(id)kSecValueData];
SecItemAdd(cfQuery, NULL);
Post not yet marked as solved
Hello!
After submitting two OSSystemExtensionRequest (let's say Endpoint and Network extensions), when the user allows only one (endpoint) extension, we receive request: didFinishWithResult callback for both manager delegates. This leads us to falsely believe that both our extensions are allowed.
We tried to prevent this by using propertiesRequestForExtension where our (network) delegate will ask for properties, check if the given extension is enabled and then finish if it's ok. If it's not enabled, however, we receive no second callback when the user allows the other extension.
We thought that we would need to submit another OSSystemExtensionRequest for the extension that wasn't allowed to receive a callback when it finally is. However, the second and all other consecutive requests immediately finish and we receive request: didFinishWithResult even when the user does not allow the second extension.
Example:
Endpoint and Network managers submit OSSystemExtensionRequest
User only allows Endpoint extension
Endpoint manager checks the properties, finds out it's enabled and finishes
Network manager checks the properties, finds out it's disabled
Network manager sends another OSSystemExtensionRequest
Network manager immediately receives request: didFinishWithResult
Network manager checks the properties, finds out it's disabled
....
This loop ends when the user finally allows the network extension, when the manager finds out that it's enabled. Is there something we are missing? Shouldn't another OSSystemExtensionRequest finish with requestNeedsUserApproval. How should we go about this issue?
Many thanks, Denis
Post not yet marked as solved
Hi,
I am experiencing following crashes intermittently in macOS network extension. Sometime in an hour or two or three. I don't see anywhere references to my project code hence i am unable to understand this crashes. Anyone please point me into right direction from here:
Crash Dumps
Samples:
Process: com.skyhighsecurity.epclient.networkextension [39224]
Path: /Library/SystemExtensions/*/com.skyhighsecurity.epclient.networkextension
Identifier: com.skyhighsecurity.epclient.networkextension
Version: 1.0 (1)
Code Type: ARM-64 (Native)
Parent Process: launchd [1]
User ID: 0
Date/Time: 2023-03-20 13:46:51.6991 +0530
OS Version: macOS 12.6.3 (21G419)
Report Version: 12
Anonymous UUID: 72617D4C-9E91-7141-D71D-9CB5BDADAA25
Sleep/Wake UUID: B462FD28-68B4-4B46-84EB-D16E29760748
Time Awake Since Boot: 32000 seconds
Time Since Wake: 5 seconds
System Integrity Protection: disabled
Crashed Thread: 3 Dispatch queue: NEFilterExtensionProviderContext queue
Exception Type: EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x0000000182e26104
Exception Note: EXC_CORPSE_NOTIFY
Termination Reason: Namespace SIGNAL, Code 5 Trace/BPT trap: 5
Terminating Process: exc handler [39224]
Application Specific Information:
BUG IN CLIENT OF LIBPLATFORM: os_unfair_lock is corrupt
Abort Cause 1949042982
Thread 0:
0 libsystem_kernel.dylib 0x182dd5d70 __sigsuspend_nocancel + 8
1 libdispatch.dylib 0x182c5b5e0 _dispatch_sigsuspend + 48
2 libdispatch.dylib 0x182c5b5b0 _dispatch_sig_thread + 60
Thread 1:
0 libsystem_pthread.dylib 0x182e07078 start_wqthread + 0
Thread 2:
0 libsystem_pthread.dylib 0x182e07078 start_wqthread + 0
Thread 3 Crashed:: Dispatch queue: NEFilterExtensionProviderContext queue
0 libsystem_platform.dylib 0x182e26104 _os_unfair_lock_corruption_abort + 88
1 libsystem_platform.dylib 0x182e21184 _os_unfair_lock_lock_slow + 328
2 libsystem_pthread.dylib 0x182e07640 pthread_mutex_destroy + 64
3 Foundation 0x183d7ac18 -[_NSXPCConnectionClassCache dealloc] + 48
4 libobjc.A.dylib 0x182cb7c58 objc_object::sidetable_release(bool, bool) + 260
5 NetworkExtension 0x19148b798 -[NEFilterSocketFlow .cxx_destruct] + 40
6 libobjc.A.dylib 0x182c9d8e4 object_cxxDestructFromClass(objc_object*, objc_class*) + 116
7 libobjc.A.dylib 0x182c94b0c objc_destructInstance + 80
8 libobjc.A.dylib 0x182c94ab8 _objc_rootDealloc + 80
9 NetworkExtension 0x19148246c -[NEFilterDataExtensionProviderContext handleSocketSourceEventWithSocket:] + 132
10 libdispatch.dylib 0x182c481b4 _dispatch_client_callout + 20
11 libdispatch.dylib 0x182c4b670 _dispatch_continuation_pop + 500
12 libdispatch.dylib 0x182c5e8e0 _dispatch_source_invoke + 1596
13 libdispatch.dylib 0x182c4f784 _dispatch_lane_serial_drain + 376
14 libdispatch.dylib 0x182c50404 _dispatch_lane_invoke + 392
15 libdispatch.dylib 0x182c5ac98 _dispatch_workloop_worker_thread + 648
16 libsystem_pthread.dylib 0x182e08360 _pthread_wqthread + 288
17 libsystem_pthread.dylib 0x182e07080 start_wqthread + 8
Before:
We had an app with app extension. Both had user privilege. Both wrote file logs to FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: groupID) - /Users/myuser/Library/Group Containers/mygroupid/
Now:
We have to change app extension to system extension. Our previous logging approach broke, because system extension has root context. Result of FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: groupID) for system extension is /private/var/root/Library/Group Containers/mygroupid/
They do not have privilege to write to each other's folder. We can open logs folder for the user, but now the app does not have privilege to open Finder window for root logs folder. Ideally we would write file in a single folder.
Question:
Please suggest where to write logs from user and root process. Maybe there is a different approach on how to store a few days worth of logs and being able to upload them to our backend, or display them to the user, upon request.
What is the difference between AppProxyProvider and TransparentProxyProvider?
I can see in documentation that NETransparentProxyProvider is derived from NEAppProxyProvider, but what was the need to add a new proxyprovider (NETransparentProxyProvider) when we already had NEAppProxyProvider?
Post not yet marked as solved
Hey all!
I have a System Extension that, while doing some other things, starts up my custom Network Extension via [NEProvider startSystemExtensionMode]. This Network Extension contains a class (let's call it MyDataProvider) that overrides the NEFilterDataProvider interface and implements handleNewFlow. MyDataProvider thus acts as a network content filter.
The problem is that installing my System Extension on a Ventura 13.4 (or older) system and starting up the Network Extension seemingly drops any ongoing connection I have. For example, my ssh connection will hang. This makes it quite annoying attempting to install the System Extension remotely.
I do not see this behavior for my other class that inherits the NEFilterPacketProvider interface.
Is this behavior expected of the NEFilterDataProvider? It seems like a bug since I do not see any documentation stating this behavior.
I am recently learning Apple's system extension using MacOS and downloaded a sample from apple's official document. https://developer.apple.com/documentation/networkextension/filtering_network_traffic, which use to filter incoming connections. An video talking about it can be found here, though a bit old.
Although I can build the sample code successfully using xcode, but the system extension is actually not started. (I have added log to verify this), specifically the main.swift under SimpleFirewallExtension folder is not loaded
I have read this article - https://www.avanderlee.com/debugging/network-extension-debugging-macos, saying if the main.swift in not loaded, there must some configuration issue in the project setup. But the project is downloaded from Apple's sample. Anyone has encounter this before?
I am using macOS Ventura version 13.1.1, Xcode version 14.3.
Post not yet marked as solved
After installing Xcode Command Line Tools, the System Settings App now asks me, to reboot my machine into recoveryOS and change the systems security to allow kernel extensions/ system extensions.
It's not prominently mentioned, but just there and I never, ever had this.
Must be a new dialog.
Well, if you click on it...
My Question is:
Why?
Kernel Extensions have been deprecated long ago (I thought) and the dialog mentions nothing specific.
I am currently writing a software product which involves a Camera Extension and a Cocoa application. I would like to share some files between the two components and as of my understanding this should be quite straightforward by putting both applications into the same App Group and then accessing the particular Group Container.
However doing so, does result in both components accessing different locations for the Group Container. I am using the following piece of code to create a new folder inside the container:
let directory = FileManager.default.containerURL(forSecurityApplicationGroupIdentifier: "group.235ADAK9D5.com.creativetoday.camskool")!
let newDirectory = directory.appendingPathComponent("Mydir")
try? FileManager.default.createDirectory(at: newDirectory, withIntermediateDirectories: false)
If I run this I find that the Cocoa application is going to access the following Location and create the file there:
/Users//Library/Group Containers//"
Where as the Camera Extension will access the following Location and create the directory there:
/private/var/db/cmiodalassistants/Library/Group Containers//
If I create a file in one directory it does not appear in the other. I tried for both components to access the opposite directory but it results in an permission denied message.
What am I doing wrong?
Post not yet marked as solved
I created a Endpoint Security the client, the System Extension have been normal load to/Library/SystemExtensions inside, and has been activated, but did not see the Extension to run, do you have who knows？
If I distribute an app through the Mac App Store that includes a Network Extension that must be installed (and getting the user's permission in the process), and later I submit an update to the app (although no changes to the network extension piece) through MAS, will the user need to re-install the Network Extension?
That is, does updating an app with that has a Network Extension remove the previous Network Extension from the system?
Post not yet marked as solved
I'm running into a strange issue that I can't figure out... I'm a bit new to macOS so I'm trying to figure out what I'm doing wrong.
I'm using an MDM (Microsoft Intune) to install the GlobalProtect VPN 6.2 client to connect to a corporate network.
Here's the situation:
macOS 12.6.7 Monterey
Managed w/ Intune and supervised through ABM
GlobalProtect 6.2 VPN client
System Extension installs successfully
Team ID + SysEx Type are permitted via MDM and appear to be OK
When I go to perform the installation, it appears to succeed, and the GP system extension appears to install successfully.
When issuing the "systemextensionsctl list" command, the GP system extension shows [activated enabled].
When I try to connect to the VPN gateway, in the VPN client logs I see:
"Error (604): failed to send ipc data: system ext not connected."
During the installation of the VPN client, I see the following in the Console log when streaming the console logs from taskgated-helper:
com.paloaltonetworks.GlobalProtect.client: Unsatisfied entitlements: com.apple.security.application-groups
Disallowing: com.paloaltonetworks.GlobalProtect.client
The subsystem for both is "com.apple.ManagedClient"
Any ideas? I'm pretty stuck.
