I want to prevent the root user from uninstall my EndpointSecurity System Extension. I succeeded to deny this when he removes with Terminal command, by intercepting ES_EVENT_TYPE_AUTH_RENAME and ES_EVENT_TYPE_AUTH_UNLINK events and answering ES_AUTH_RESULT_DENY for the Extension's application in /Applications folder. However, when the user drag&drops the Extension's application to the Trash, he succeeds. More than that, it looks like I don't receive any event about it in the Extension. Thanks.

Hi, I have been following the steps presented in https://developer.apple.com/documentation/coremediaio/creating_a_camera_extension_with_core_media_i_o to create a core media I/O camera. However when calling let activationRequest = OSSystemExtensionRequest.activationRequest( forExtensionWithIdentifier: identifier, queue: .main ) activationRequest.delegate = installDelegate OSSystemExtensionManager.shared.submitRequest(activationRequest) The delegate's request(_ request: OSSystemExtensionRequest, didFailWithError error: Error) method is being called with error code 9 (OSSystemExtensionError.Code.validationFailed) and the system dialog does not appear.

I developed a screen watermarking program that worked fine before macOS 12.4. After upgrading to 12.4, "System Extension Blocked" pop-up cann't be click, but the other window is ok. Any body can tell me the macOS 12.4 has do what to "System Extension Blocked" pop-up !!! my sample code like this code-block NSScreen *screen = [NSScreen screens][0]; CGFloat windowWidth = screen.frame.size.width; CGFloat windowHeight = screen.frame.size.height; CGFloat x = screen.frame.origin.x; CGFloat y = screen.frame.origin.y; MyView* view = [[MyView alloc]initWithFrame:NSMakeRect(0, 0, windowWidth, windowHeight)]; NSWindow* window = [[NSPanel alloc] initWithContentRect:NSMakeRect(0, 0, windowWidth, windowHeight) styleMask: NSWindowStyleMaskBorderless | NSWindowStyleMaskNonactivatingPanel backing:NSBackingStoreBuffered defer:NO]; [window setOpaque:NO]; [window setBackgroundColor:[NSColor clearColor]]; [window setCollectionBehavior:NSWindowCollectionBehaviorCanJoinAllSpaces | NSWindowCollectionBehaviorFullScreenAuxiliary]; [window setIgnoresMouseEvents:YES]; [window setHasShadow:NO]; [window setLevel:NSScreenSaverWindowLevel]; [window setContentView:views]; [window makeKeyAndOrderFront:nil]; and draw in MyView code-block - (void)drawRect:(NSRect)dirtyRect { NSRect screen = [self bounds]; int SW = screen.size.width; int SH = screen.size.height; [[NSColor clearColor] set]; NSRectFill(screen); NSString * strH= @"watermark test."; NSMutableDictionary *md = [NSMutableDictionary dictionary]; [md setObject:[NSFont fontWithName:@"Times" size:80] forKey:NSFontAttributeName]; [strH drawAtPoint:NSMakePoint(SH*0.5, SH*0.5) withAttributes:md]; [self setNeedsDisplay:YES]; }

I have a requirement where I need to monitor writes/reads from arbitrary USB devices. Can I do it with USBDriverKit?

I've implemented a custom VPN system extension for macOS (Packet Tunnel Provider). I created a tunnel, and I have a VPN connection, with the default (IPv4) routes. My question is about sending traffic which was originated at the extension, via the tunnel. Is it possible to create a BSD socket at the extension, and bind it to a specific interface, so the traffic (that was created from the extension) for this socket will be routed via the tunnel?

I have an app which is installing a system extension. On startup I want to know if it's already been installed or not (because if it hasn't I want to show some information to the user). I have not been able to find an ObjC or Swift method that allows me to ask if a given extension has been installed. I know I can run systemextensionctl list and parse the output but I don't want to have to fork a shell command if I don't have to.

We have a macOS app that contains a system extension content filter as part of the app bundle. The main container app is a relatively simple process to perform activation and deactivation of the content filter. From guidance given on this forum, our container app has a GUI component (AppDelegate) which on launch activates the content filter if needed, e.g. on initial install or update. This works as intended, provided the user is logged in. However, we would normally expect the install/update/removal to be performed by remote management, e.g. pushed by JAMF, which often happen when no user was logged in on the device. Note, we have a MDM profile which provides pre-authorization of the system extension and content filter to negate the requirement for the user to respond to prompts during install. Trying to perform a remote install or removal, requires calling the main container app to run without a logged in user which fails because the app terminates as there is no GUI context to run in. Trying a container app without a GUI component appears to be unreliable and often hangs during content filter activation. What is the correct way to perform installation or removal, without a user login, via remote management?

This is on an M1 MacBook Pro running 11.1b1. I installed an Extension from Rogue Amoeba to support their App Suite. Boot into recovery to set system policy to allow user permission of extensions Reboot and install extension Allow Extension in Preferences > Security panel Allow rebuild and restart. It comes up with an endless loop of failure due to an Extension from Apple Inc. ! The Rogue Amoeba extension loads fine. Any ideas?

Hi, I'm looking for a developer to update a currently Intel-only legacy kext into a system extension so it works on M1 / ARM / Apple Silicon. Here's the problem: I'm a heavy user of a legacy software named ControllerMate. Unfortunately, it has been abandoned by the developer and he didn't make it open-source. The latest update was in late 2018 and the developer has stopped responding entirely and can not be reached, even to previous beta-testers. Confirmed by several power users who tried over the years. The app basically allows creation of macros and cascades and is extremely powerful. It's used by many people in the video post production and music production space in their professional workflows, and people built individual workflows around this over the years to work faster and more efficiently. Since it hasn't been updated, people are somewhat stuck and can't upgrade without breaking their workflows. Especially now with the new and powerful M1s, this becomes much more urgent and relevant again. The kext might have to be reverse engineered or hacked - I know, not something people in an Apple developer forum wanna hear, but we're desperate to find somebody for this and keep this going. I truly appreciate any input, insights and leads! Thank you!

I've implemented a custom system-extension VPN (Packet Tunnel Provider) for macOS. At the extension, I need to use a 3rd party dynamic lib. The steps I did: Build phases: Copy files, with Frameworks destination Link Binary With Libraries Build Settings: I set 'Dynamic Library Install Name', 'Dynamic Library Install Name Base', and 'Library Search Path' to the lib folder I set 'Header Search Path' to the headers folder But when running the extension, it's crashing with the error Termination Reason: Namespace DYLD, Code 1 Library missing Library not loaded: @loader_path/somelib.dylib And Reason: tried: '/Library/SystemExtensions/A1111-someID-11111/com.myapp.myappSysExtension.systemextension/Contents/MacOS/libwavmodapi.dylib' (no such file), '/usr/local/lib/libwavmodapi.dylib' (no such file), '/usr/lib/libwavmodapi.dylib' (no such file) (terminated at launch; ignore backtrace) Any idea what I'm doing wrong here? Also, is it even possible to use dynamic libs from a sys-ext?

I manage a system that automatically generates system extensions, and in order to ensure that every release's dext can be activated over top of any other release, I have it increment the dext's CFBundleVersion so that every release has a unique version number. However I just hit an error where, once CFBundleVersion reached 10000, dext activation would fail with this error: Property "CFBundleVersion" must be a valid kext version Apparently the maximum value any one of the three digits can be for CFBundleVersion is 9999, at least for a dext. So if CFBundleVersion only uses one number as opposed to three, it can't go higher than 9999. Note that I found this out from experimentation. No where in Apple's documentation have I found any mention of this restriction, including, most distressingly, in the docs for CFBundleVersion. Since I'm programmatically assigning this value, now I need to know: Are there any other requirements or restrictions for CFBundleVersion? I'm curious if there are any in the context of an app (be it on macOS, iOS, tvOS, and so on) or other types of extensions, as well as with a DriverKit extension.