EnpointSecurity System Extension is crashing in macOS Sonoma

Hi All,

We have Endpoint Security System Extension. We are facing an issue in macOS Sonoma only where we have found that open() API is not returning any response when we try to open the files and OS killing/crashing the extension.

We have found in log streaming below lines for our extension:

error	12:50:51.093673+0530	tccd	Failed to create LSApplicationRecord for file:///Library/SystemExtensions/3378971F-D41D-4230-A887-E0DC0F61E98D/com.*.sysextcontainer.onlineext.systemextension/: 'The operation couldn’t be completed. (OSStatus error -10811.)'

It seems internally some access is removed by apple on booting however we can still see our extension has Full Disk Access in System Settings.

We have installed new macOS Sequoia Public beta 24A5289h and above issue is not observed and also issue not seen in previous OS(Big Sur, Monterey, Ventura) and seen only in Sonoma.

We already have filed a Feedback : FB13806349

...

Thanks & Regards,

Mohmad Vasim

EnpointSecurity System Extension is crashing in macOS Sonoma
 
 
Q