I explored Apple's Filtering Network Traffic sample. I noticed for me, FilterDataProvider's startFilter method is called only when I make filterManager.grade = .inspector before calling filterManager.saveToPreferences. Could someone help why the startFilter is not called when I leave the filterManager's grade property with it's default value. i.e NEFilterManagerGradeFirewall? https://developer.apple.com/documentation/networkextension/filtering_network_traffic

Hi,Team: I successfully installed the system extension through MDM and want to uninstall it through RemovableSystemExtensions, but this command does not support versions below macOS 12. Is there any other way to pause or uninstall the system extension? Can I delete the configuration file that allows system extensions through MDM? Or send and delete the configuration file of AllowedSystemExtensions?

Hi, Team: I developed a network filter and used MDM to issue a description file. By configuring AllowedSystemExtensions, I can avoid the reminder of loading system extensions during installation. However, when savingToPreferencesWithCompletionHandler, I will still be reminded that my network data is monitored. How can I configure MDM to avoid this reminder? And why can I still delete the filter from the network filter conditions even though I configured it in mobileconfig in the following way. NonRemovableFromUISystemExtensions com.mysystemextensionid

Hi everyone, I am developing a MacOS app where a network extension and a content filter are installed as system extensions when the app is launched. I'd like to test the flow where user get a "System Extension Blocked" prompt like this: But I couldn't find a way to revoke the approval I gave at the first place. I've tried remove the system extensions using "sudo systemextensionsctl uninstall [TEAM ID] [BUNDLE ID]" with SIP disabled but no luck. I've also tried to remove them from the KextPolicy database but they are not even in the database. I am on MacOS Sonoma 14.5. All I want is to revoke the system extension approval and recreate this prompt. Has anyone experienced a similar issue or have any suggestions on how to achieve this?

I am developing a camera extension as described here Creating a camera extension as described in Creating a camera extension with Core Media I/O. To ensure this wasn't some issue with my code, I reverted to the sample code added when you choose File > New > Target > Camera Extension in Xcode, in other words, I am using the example code provided by Apple. I am able to install the camera extension and see it in QuickTime Player, where I choose it as the video input. In QuickTime Player I see the white line generated by the sample code moving up and down. For some period of time, it works. But eventually, the video in QuickTime Player freezes. The thing that's really weird is if I add some NSLog() statements at the point in the code where it returns the newly created sample: [self->_streamSource.stream sendSampleBuffer:sbuf discontinuity:CMIOExtensionStreamDiscontinuityFlagNone hostTimeInNanoseconds:(uint64_t)(CMTimeGetSeconds(timingInfo.presentationTimeStamp) * NSEC_PER_SEC)]; the samples are still being generated and sent to the stream. But the apparently QuickTime Player has decided to stop consuming them. I thought maybe setting the discontinuity parameter to CMIOExtensionStreamDiscontinuityFlagTime or CMIOExtensionStreamDiscontinuityFlagSampleDropped if the delta time since the last sample was generated was off by a tiny bit, but this did not improve the situation. Finally, could this have something to do with frequently installing and uninstalling my camera extension as part of the debugging and testing process? Thanks in advance for any advice you might have!

WireGuard Apple VPN Client App for macOS with System Extension to Distribute Outside App Store Checkout the source code of WireGuard Apple. https://github.com/WireGuard/wireguard-apple I have fixed several issues and now I can create and connect to the VPN. This source code uses the App Network Extension (appex) which can only be distributed on the App Store. But I don't want to distribute it via the App Store. I will distribute it outside the App Store. But for this, we need to sign the app with the Developer ID Application certificate and we also need to notarize it. So for this, the App Network Extension (appex) will not help. We need to use the System Extension Network Extension (sysex). So we need to make changes to the WireGuard Apple source code to be able to connect the VPN via the System Extension Network Extension (sysex), this means we need to migrate existing App Network Extension (appex) to System Extension Network Extension (sysex) in this source code. I am facing this challenge, that's why I am looking for a solution here. I have already done changes explained here https://forums.developer.apple.com/forums/thread/695550. Also done with changes for getting system extension permission and network extension permission. Real problem is, VPN client app is not getting connect to VPN and to fix this, we need to fix in WireGuard Apple Kit source code. Please help me to solve this problem.

Hi Team, Is there a way to disable secure DNS in macOS that is set at the OS level, like 8.8.8.8, which supports secure DNS on ports 443 and 853?

Hi Team: I first created a macOS app and added a target of the network extension of the system extension to the app. The function of my app is to enable the system extension and allow the network extension. The app only enables the network filter and does not perform other operations. After completion, it will execute [NSApp terminate:nil]; to exit. My network filter can run normally after the app exits, and I use rm -rf to delete the app from /Application, and the network filter can still run normally. This result is what I want, but I don’t know if it is reasonable to delete the app from /Application. My understanding is that the network filter I developed is registered with the system, so it is okay to delete it from /Application. Is this correct?

I'm the developer of a third-party keyboard app, Snippety - Snippets Manager, which is designed for using snippets rather than regular typing. One of my users has encountered a strange issue: after installing my keyboard (even when it is not actively in use), the predictive text bar starts showing suggestions in Polish. This happens despite the Polish language not being installed on the device. The issue resolves as soon as my keyboard is uninstalled from the system settings. Interestingly, my application (including the keyboard) does not support the Polish language, nor is Polish specified anywhere in the app. The app was developed and published from macOS in English. This seems to be an iOS bug. The only language-related configuration in my keyboard is the PrimaryLanguage key in the Info.plist file, which I set to "mul" because the keyboard is not intended for typing. I also tried setting it to "mis", but the issue persists. The video presenting this issue on an iPhone 15 simulator running iOS 17.5: https://www.dropbox.com/scl/fi/xjdyucxpmv1cv0mnmwzvd/prdictive-text-issue.mp4?rlkey=aphznpdti08pz8xl84ojbyxz3&dl=0 Info.plist for my keyboard: My project settings: Steps to reproduce: Configure iOS to use English language only, with English keyboard Enable predictive text feature in the system Install Snippety keyboard Use the regular keyboard & start typing "dzie" Actual result: Polish predictions appear even though the Polish language is not installed or declared by the keyboard. Expected result: The predictive text should present predictions based on system settings. What is even more weird, I discovered that when I add the keyboard in system settings, it automatically installs Polish language in the system settings. I even changed PrimaryLanguage to "de" (German) in Info.plist but it still installs Polish. See: https://www.dropbox.com/scl/fi/aiv5g4z331zwy827zj47v/incorrect-language-installed.mp4?rlkey=16v5gqmb6mj8yuyyd7jwmjnsw&dl=0 Any ideas what could be wrong? I also created a ticket: #FB13949087 I also found a similar issue from 2018 (O_O) reported here: https://stackoverflow.com/questions/53069262/ios-adds-new-preferred-language-when-installing-my-3rd-party-keyboard

hi, all I subscribe AUTH_SIGNAL event with ESF. and test if it can prevent Activity Monitor from killing processes in the list below. I can stop "Force Quit"(sigkill) to all five processes, but "Quit"(sigterm?) to four processes except "Typora". I'm pretty sure that I didn't get a signal event when I used Activity Monitor to "Quit" typora. how Activity Monitor "Quit" the "Typora"? it looks like the Activity Monitor "Quit" the App Process with a different way(not through sending signal).

I struggle to add custom properties to my streams as described in the WWDC22 video https://developer.apple.com/videos/play/wwdc2022/10022/ minute 28:17 The speaker describes using this technique in his CIFilterCam demo (would the source code be available please?) to let the app control which filter the extension should apply. Presumably, there's thus a way to: 1 - define a custom property in the camera extension's stream/device/provider? 2 - be able to use CoreMediaIO (from Swift?) in the app in order to set values of that custom property. This is not documented anywhere I could find. Help and sample code would be greatly appreciated. Thank you. Laurent

I'm attempting to create an application that uses a System Extension / Network Extension to implement a PacketTunnelProvider. After creating and configuring the packet device, I want to spawn a child process to do the actual reading and writing of network packets. I want to do this because the child is written in Go (it uses wireguard-go and my company's Go-SDK). When I call posix_spawn from within the System Extension, I get "Operation not permitted" as the error, and sandboxd drops a log with Violation: deny(1) process-exec* /private/var/root/Library/Containers/<my system extension>/Data/Documents/<my-child-binary> Is it possible to execute other processes from within the System Extension sandbox? Do the binaries have to be stored in a particular place, and if so, where? I attempted to build with the App Sandbox removed from the System Extension capabilities, and this seemed to fail before even executing my Network Extension code, so I'm guessing System Extensions are required to be sandboxed, but it would be nice to have that confirmed.

Hi! I'm trying to move from CoreMedio I/O DAL Plug-In to CoreMedia I/O camera extensions, announced in macOS 12.3. I created a test extension, placed it inside my app bundle into Contents/Library/SystemExtensions and signed with codesigning certificate. But when I try to install my extension from inside my app, using this code (Swift): func requestActivation() { guard case .idle = status else { fatalError("Invalid state") } print("Requesting activation of extension \"\(extensionIdentifier)\"") let req = OSSystemExtensionRequest.activationRequest(forExtensionWithIdentifier: extensionIdentifier, queue: DispatchQueue.main) req.delegate = self OSSystemExtensionManager.shared.submitRequest(req) status = .requested } I'm getting an error: OSSystemExtensionErrorDomain error 8: Code Signature Invalid which is rather generic. Can anybody tell me what I am doing wrong? Or at least propose some steps to find it out? I'm posting here entitlements and codesign output for my extension and containing application for further information. kdg@admins-Mac-mini SystemExtensions % codesign -d --entitlements - ./com.visicom.VirtualCamera.avextension.systemextension Executable=/Applications/VirtualCamera.app/Contents/Library/SystemExtensions/com.visicom.VirtualCamera.avextension.systemextension/Contents/MacOS/com.visicom.VirtualCamera.avextension [Dict] [Key] com.apple.security.app-sandbox [Value] [Bool] true [Key] com.apple.security.application-groups [Value] [Array] [String] 6SUWV7QQBJ.com.visicom.VirtualCamera kdg@admins-Mac-mini /Applications % codesign -d --entitlements - ./VirtualCamera.app Executable=/Applications/VirtualCamera.app/Contents/MacOS/VirtualCamera [Dict] [Key] com.apple.developer.system-extension.install [Value] [Bool] true [Key] com.apple.security.app-sandbox [Value] [Bool] true [Key] com.apple.security.application-groups [Value] [Array] [String] 6SUWV7QQBJ.com.visicom.VirtualCamera [Key] com.apple.security.files.user-selected.read-only [Value] [Bool] true kdg@admins-Mac-mini SystemExtensions % codesign -dvvv ./com.visicom.VirtualCamera.avextension.systemextension Executable=/Applications/VirtualCamera.app/Contents/Library/SystemExtensions/com.visicom.VirtualCamera.avextension.systemextension/Contents/MacOS/com.visicom.VirtualCamera.avextension Identifier=com.visicom.VirtualCamera.avextension Format=bundle with Mach-O universal (x86_64 arm64) CodeDirectory v=20500 size=1553 flags=0x10700(hard,kill,expires,runtime) hashes=37+7 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=25bd80657bfd6e0ab95467146c7b532817e9e520 CandidateCDHashFull sha256=25bd80657bfd6e0ab95467146c7b532817e9e5209fd50b0cb7ceef40dcfb40e8 Hash choices=sha256 CMSDigest=25bd80657bfd6e0ab95467146c7b532817e9e5209fd50b0cb7ceef40dcfb40e8 CMSDigestType=2 CDHash=25bd80657bfd6e0ab95467146c7b532817e9e520 Signature size=9006 Authority=Developer ID Application: Visicom Media Inc. (6SUWV7QQBJ) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=7 Jul 2022, 21:49:32 Info.plist entries=23 TeamIdentifier=6SUWV7QQBJ Runtime Version=12.3.0 Sealed Resources version=2 rules=13 files=0 Internal requirements count=1 size=200 kdg@admins-Mac-mini /Applications % codesign -dvvv ./VirtualCamera.app Executable=/Applications/VirtualCamera.app/Contents/MacOS/VirtualCamera Identifier=com.visicom.VirtualCamera Format=app bundle with Mach-O universal (x86_64 arm64) CodeDirectory v=20500 size=1989 flags=0x10700(hard,kill,expires,runtime) hashes=51+7 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=31e15fbbd436a67a20c5b58c597d8a4796a67720 CandidateCDHashFull sha256=31e15fbbd436a67a20c5b58c597d8a4796a6772020308fb69f4ee80b4e32788b Hash choices=sha256 CMSDigest=31e15fbbd436a67a20c5b58c597d8a4796a6772020308fb69f4ee80b4e32788b CMSDigestType=2 CDHash=31e15fbbd436a67a20c5b58c597d8a4796a67720 Signature size=9006 Authority=Developer ID Application: Visicom Media Inc. (6SUWV7QQBJ) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=7 Jul 2022, 21:58:09 Info.plist entries=20 TeamIdentifier=6SUWV7QQBJ Runtime Version=12.3.0 Sealed Resources version=2 rules=13 files=4 Internal requirements count=1 size=188 Thanks in advance!

Hi! I'm trying to move from CoreMedio I/O DAL Plug-In to CoreMedia I/O camera extensions, announced in macOS 12.3. I created a test extension, placed it inside my app bundle into Contents/Library/SystemExtensions and signed with codesigning certificate. But when I try to install my extension from inside my app, using this code (Swift): func installDriver() { guard let extensionIdentifer = DriverInstaller.extensionBundle().bundleIdentifier else { return } let activationReq = OSSystemExtensionRequest.activationRequest(forExtensionWithIdentifier: extensionIdentifer, queue: .main) activationReq.delegate = self OSSystemExtensionManager.shared.submitRequest(activationReq) } I'm getting an error: OSSystemExtensionErrorDomain error 8: Code Signature Invalid which is rather generic. Can anybody tell me what I am doing wrong? Or at least propose some steps to find it out? I'm posting here entitlements and codesign output for my extension and containing application for further information. Executable=../Contents/Library/SystemExtensions/com..RoomDevice.Extension.systemextension/Contents/MacOS/com..RoomDevice.Extension [Dict] [Key] com.apple.security.app-sandbox [Value] [Bool] true [Key] com.apple.security.application-groups [Value] [Array] [String] 893K7MTL2H. com.. [Key] com.apple.security.device.camera [Value] [Bool] true Executable=**********/Contents/MacOS/***** [Dict] [Key] com.apple.application-identifier [Value] [String] 893K7MTL2H.com..RoomDevice [Key] com.apple.developer.system-extension.install [Value] [Bool] true [Key] com.apple.developer.team-identifier [Value] [String] 893K7MTL2H [Key] com.apple.security.application-groups [Value] [Array] [String] 893K7MTL2H. com..******** Executable=***/Contents/MacOS/**** Identifier=com..RoomDevice Format=app bundle with Mach-O universal (x86_64 arm64) CodeDirectory v=20500 size=1345 flags=0x10000(runtime) hashes=31+7 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=3584714367d59119b462d0f830247d27ff1fbace CandidateCDHashFull sha256=3584714367d59119b462d0f830247d27ff1fbace53419d69abaa658fbb7a4f12 Hash choices=sha256 CMSDigest=3584714367d59119b462d0f830247d27ff1fbace53419d69abaa658fbb7a4f12 CMSDigestType=2 Launch Constraints: None CDHash=3584714367d59119b462d0f830247d27ff1fbace Signature size=4688 Authority=Developer ID Application: ****************(893K7MTL2H) Authority=Developer ID Certification Authority Authority=Apple Root CA Signed Time=01-Sep-2023 at 12:00:09 PM Info.plist entries=22 TeamIdentifier=893K7MTL2H Runtime Version=13.3.0 Sealed Resources version=2 rules=13 files=6 Internal requirements count=1 size=216 Executable=/Contents/Library/SystemExtensions/com.*****.RoomDevice.Extension.systemextension/Contents/MacOS/com..RoomDevice.Extension Identifier=com.******.RoomDevice.Extension Format=bundle with Mach-O universal (x86_64 arm64) CodeDirectory v=20500 size=3627 flags=0x10000(runtime) hashes=102+7 location=embedded Hash type=sha256 size=32 CandidateCDHash sha256=70580825016b7e262fb15c280ba380ad4e871bc1 CandidateCDHashFull sha256=70580825016b7e262fb15c280ba380ad4e871bc108951adb8cd474d652567f4f Hash choices=sha256 CMSDigest=70580825016b7e262fb15c280ba380ad4e871bc108951adb8cd474d652567f4f CMSDigestType=2 Launch Constraints: None CDHash=70580825016b7e262fb15c280ba380ad4e871bc1 Signature size=4688 Authority=Developer ID Application: ************ Ltd. (893K7MTL2H) Authority=Developer ID Certification Authority Authority=Apple Root CA Signed Time=01-Sep-2023 at 12:00:05 PM Info.plist entries=22 TeamIdentifier=893K7MTL2H Runtime Version=13.3.0 Sealed Resources version=2 rules=13 files=0 Internal requirements count=1 size=224 Please anyone help. Thanks in advance!

Documentation for System Extensions talk about an "appropriate" Applications directory, but doesn't specify what this is. /Applications and its subdirectories qualifies, but are there more? Did this change in macOS 15 Sequoia? Installing System Extensions and Drivers : Your app is installed in an appropriate Applications directory of the system. OSSystemExtensionErrorUnsupportedParentBundleLocation: The app itself must be in one of the system’s Applications directories. Background: while testing one of our apps with a VPN Network Extension on the current Sequoia beta, it seems that the restrictions got tighter. I'm able to run this app in my user's ~/Applications on macOS 14.6.1, but on macOS 15.1 beta I get this error now: Error Domain=OSSystemExtensionErrorDomain Code=3 "App containing System Extension to be activated must be in /Applications folder. Current location: file:///…

Our app has a network system extension that it uses and during the install process we prompt the user to go to "Security &amp; Privacy" in Settings to Allow it to run. A lot of the time users just kit "Ok" without actually going to the Settings and when they go to use the App we have no way, that we know of, to tell if the startup has failed because they just haven't Allow the extension to run. Is there an API call that we can use to determine if our extension has been Allowed so that if it hasn't we can prompt them to go to Settings again?

Hi all, It's nice that macOS 15 allows users to control System Extensions in "Login Items & Extensions", but I am encountering some issues in determining if a user has disabled or removed a System Extension. I will share my findings (as of macOS 15.1 24B5009l) for two scenarios and would appreciate any suggestions for better approaches. Scenario 1: During first-time activation, there is no clear API to determine if the user uninstalls the extension before activation. The code creates activationRequestForExtension:queue: and receives notifications via a delegate implementing OSSystemExtensionRequestDelegate. However, if the user does not authorize the activation of the System Extension and uninstalls it, the code receives request:didFailWithError: with error code OSSystemExtensionErrorRequestSuperseded. This error code is ambiguous, so I plan to submit a propertiesRequestForExtension:queue: and check the properties for each instance to determine if the user uninstalled the extension. Scenario 2: After activation, it is unclear when the user enables or disables the extension. It is somewhat easier in the enabled -> disabled scenario. The XPC connection will be invalidated, allowing me to submit another propertiesRequestForExtension:queue: in the XPC invalidation handler and check the result. However, I am having trouble with the disabled -> enabled scenario. There is no event or trigger indicating that the user has enabled the extension, so I have to submit propertiesRequestForExtension:queue: repeatedly at short intervals, which is not ideal. I wonder if there are better approaches. Any suggestions would be greatly appreciated. Thanks & regards, Shay

Hi! I am experimenting with NEAppProxyProvider (I just want to see the differences between this and NETransparentProxyProvider in action). I have subclassed it in my system extension and it seems like it reaches the startProxy point because I see the corresponding logs. I didn't forget to call the completion handler. However, I do not see logs about flow handling. Can you suggest to me why? Posting the extension source code just in case. import Foundation import NetworkExtension import OSLog class AppProxyProvider: NEAppProxyProvider { override func startProxy(options: [String : Any]? = nil, completionHandler: @escaping (Error?) -&gt; Void) { Logger.appProxyProviderSystExt.warning("Starting NEAppProxy") setTunnelNetworkSettings(configureProxy()) { error in if let error { Logger.appProxyProviderSystExt.warning("\(#functicompletionHandler(nil)on) Unable to set settings for NEAppProxy syst ext") completionHandler(error) return } completionHandler(nil) } } override func handleNewFlow(_ flow: NEAppProxyFlow) -&gt; Bool { Logger.appProxyProviderSystExt.warning("Handling flow") return false } override func stopProxy(with reason: NEProviderStopReason, completionHandler: @escaping () -&gt; Void) { Logger.appProxyProviderSystExt.warning("Stopping NEAppProxy") completionHandler() } override func handleAppMessage(_ messageData: Data, completionHandler: ((Data?) -&gt; Void)? = nil) { completionHandler?(nil) } private func configureProxy() -&gt; NETunnelNetworkSettings { let settings = NETunnelNetworkSettings(tunnelRemoteAddress: "127.0.0.1") return settings Am I missing something in configuration?

Hi All, We have Endpoint Security System Extension. We are facing an issue in macOS Sonoma only where we have found that open() API is not returning any response when we try to open the files and OS killing/crashing the extension. We have found in log streaming below lines for our extension: error 12:50:51.093673+0530 tccd Failed to create LSApplicationRecord for file:///Library/SystemExtensions/3378971F-D41D-4230-A887-E0DC0F61E98D/com.*.sysextcontainer.onlineext.systemextension/: 'The operation couldn’t be completed. (OSStatus error -10811.)' It seems internally some access is removed by apple on booting however we can still see our extension has Full Disk Access in System Settings. We have installed new macOS Sequoia Public beta 24A5289h and above issue is not observed and also issue not seen in previous OS(Big Sur, Monterey, Ventura) and seen only in Sonoma. We already have filed a Feedback : FB13806349 ... Thanks & Regards, Mohmad Vasim

hi! I know endpoint security sysext with earlyboot property key enabled will run before all other applications run while system booting. presume all these are done before earlyboot time out: sysext run it's host app, host app notify sysext to subscribe some events through xpc, then other apps start runing. though this whole process seems to violate "sysext runs before all other applications run"... I still wonder is this possible?