sysextd: "no policy, cannot allow apps outside /Applications" - NEFilterDataProvider system extension on macOS 26

Question

Created 6h

Replies 1

Boosts 0

Participants 1

I'm developing a macOS security tool using NEFilterDataProvider as a system extension. On macOS 26 beta (25E241), sysextd consistently rejects my extension with:

sysextd: no policy, cannot allow apps outside /Applications

Configuration:

App installed in /Applications/
Signed with Developer ID Application (693DSH8GN5)
Entitlement: com.apple.developer.networking.networkextension = content-filter-provider
com.apple.developer.system-extension.install = true
Developer Mode enabled on test machine

Comparison with Little Snitch:

Little Snitch runs correctly on the same machine. Key differences I found:

Little Snitch uses content-filter-provider-systemextension instead of content-filter-provider
Little Snitch has com.apple.security.app-sandbox = false
Both signed with Developer ID Application

When I switch to content-filter-provider-systemextension, Xcode rejects every provisioning profile because none match that entitlement value, and the Developer Portal doesn't expose fine-grained control over the Network Extensions array values.

Questions

Is content-filter-provider-systemextension the correct entitlement for system extensions on macOS 26?
How should the provisioning profile be configured to support it?
Is there a known sysextd issue on macOS 26 beta causing this regardless of configuration?
Is there - somewhere! - a guide on how to build such an extension?

Thanks in advance for your help.

Boost

Answer 1

gbiondo OP

3h

Update: After inspecting all provisioning profiles on our system, we found that:

Profiles generated for development and Developer ID distribution contain content-filter-provider Profiles generated via Direct Distribution contain only packet-tunnel-provider-systemextension and app-proxy-provider-systemextension No profile contains content-filter-provider-systemextension

When we set content-filter-provider-systemextension in the entitlements file (matching Little Snitch's configuration), Xcode rejects all available profiles with a mismatch error. This means the Developer Portal does not appear to generate provisioning profiles with content-filter-provider-systemextension for content filter system extensions. Is this a portal issue, or is there a different provisioning mechanism required?

0