Moving app to the trash doesn't deactivate system extension

I'm testing my NEFilterDataProvider system extension by building it in Xcode and then copying the built app into the Applications folder.

When I do changes to the extension's code, obviously the system extension process currently running needs to be shut down or restarted when I launch the new app version. Increasing the app version and build numbers each time always seem to trigger the system extension update in macOS, but that's not so convenient and at the latest when publishing the update those numbers cannot just make arbitrary jumps.

I've read that moving an app to the trash should uninstall any attached system extensions, and this seems to be confirmed by the alert that macOS shows when doing so, but even after clicking Continue and authenticating with Touch ID to confirm the uninstall and emptying the trash, it sometimes happens that when launching the next version of my app from the Applications folder the old system extension is still running, which I notice e.g. because the app crashes since it's using different IPC method signatures than the system extension. When checking in Activity Monitor the system extension is also still listed.

Even restarting the Mac doesn't always solve the issue, so when this happens my only solution is to increase the build and version numbers to make it work, and then reset them later when moving the app to the trash correctly uninstalls the system extension again. Is this a bug or am I missing something? Or is there a workaround that doesn't involve booting into safe mode and manually uninstalling the system extension?

P.S.: I just tried booting into safe mode and moving the files from /Library/SystemExtensions to the trash as suggested on discussions.apple.com, but I got an alert saying that I didn't have the privileges to do so.

Is this a bug or am I missing something?

How are you installing the extension, is it through an app container and not a daemon process? The reason I ask is because you can get into a situation like this if you are installing the System Extension from a daemon and not an app. By app I mean a full container app where the user clicks a button to install the extension.

I install it through a container app which shows the "System Extension Blocked" alert.

If you can reproduce this reliably on a VM with SIP enabled by building your container app and installing it into the /Applications folder and then starting the Network System Extension from the container app, then stopping the container app, removing the network configuration, and then deleting the container app and this does not stage the System Extension for removal then you may have a run into a possibly bug with the System Extension machinery. If all of this is true then you should open a bug with a sysdiagnose. Post your bug report here.

I never removed the network configuration (I assume you mean in System Settings > Network). I just quit the container app and deleted it. When rebuilding it, moving it to /Applications and launching it again, sometimes I get the "System Extension Blocked" alert showing that the extension was deleted alongside the container app, but sometimes I don't.

Did you remove the container app using Finder? I just saw a bug go by (r. 117129546) suggesting that the system extension smarts do not kick in if you remove it with Launchpad O-:

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Did you remove the container app using Finder?

Yes.

Moving app to the trash doesn't deactivate system extension
 
 
Q