System extensions in macOS
Overview
A Mac with macOS 10.15 or later allows developers to extend the capabilities of macOS using system extensions. In comparison to kernel extensions that inherently have full access to the entire operating system, system extensions running in user space are granted only the privileges necessary to perform their specified function. This approach helps to maintain the stability, integrity, and security of macOS.
System extensions also support a robust set of management options. using a device management service you can:
Allow a specific extension to load without user interaction.
Unload an extension by removing the configuration. This also marks it for removal on the next restart of the Mac.
Allow all extensions from a specific developer to load without user interaction.
Allow all extensions of a specific type (like network extensions) to load without user interaction.
Prevent users from approving system extensions to load.
If an extension is not managed by a configuration and the operating system tries to load or unload it, an interactive authentication dialog appears that requires authorization by an administrator. For those scenarios, you can also specify which apps can remove their own system extensions without requiring administrator authentication. This is especially useful for vendors that may provide automated uninstallers for their apps.
Kernel extensions
Kernel extensions on a Mac with macOS 11 can’t be loaded into the kernel on demand. They require administrator approval and a restart of the Mac. Additionally, they require that secure boot mode be set to Reduced Security.
Developers can use frameworks such as DriverKit and NetworkExtension to write USB and human interface drivers, endpoint security tools (like data loss prevention or other endpoint agents), and VPN and network tools, all without needing to write kernel extensions. Third-party security agents should be used only if they take advantage of these APIs.
Important: Kernel extension are no longer recommended for macOS as they risk the integrity and reliability of the operating system. Users should prefer solutions that don’t require extending the kernel and use system extensions instead.
Allow kernel extensions
If you need to use kernel extensions, review the approval methods based on enrollment method.
Enrollment method | Approval method | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Not enrolled User Enrollment | Using kernel extensions requires a restart to recoveryOS to downgrade security settings. The user needs to press and hold the power button to restart into recoveryOS and authenticate as an administrator. Only when recoveryOS is entered using the power button press does the Secure Enclave accept the change of policy. The user needs to then select the checkbox Reduced Security and the option “Allow user management of kernel extensions from identified developers” and restart the Mac. When a new kernel extension is installed and there’s an attempt to load it, a restart needs to be initiated by the user from the warning dialog in System Settings > Privacy & Security. This restart initiates the rebuild of the auxiliary kernel collection that is used by the kernel when booting. | ||||||||||
Device Enrollment | The device management service needs to notify the user to restart into recoveryOS to downgrade security settings. The user needs to press and hold the power button to restart into recoveryOS and authenticate as an administrator. Only when using the power button press does the Secure Enclave accept the change of policy. The user needs to then select Reduced Security, select “Allow remote management of kernel extensions and automatic software updates,” and restart the Mac. Every time a new kernel extension is installed and there’s an attempt to load it, a restart needs to be initiated by either:
To learn if this feature is supported for your devices, consult your developer’s device management service documentation. | ||||||||||
Automated Device Enrollment (The serial number of the Mac needs to appear in Apple School Manager or Apple Business, and the Mac needs to enroll in a device management service that links to Apple School Manager or Apple Business.) | Device management services can set the secure boot policy automatically to Reduce Security using a bootstrap token when a profile to allow a kernel extension is applied. The same process including a restart as for Device Enrollment is required to enable a kernel extension. To learn if this feature is supported for your devices, consult your developer’s device management service documentation. | ||||||||||
Kernel extensions with System Integrity Protection
If System Integrity Protection (SIP) is enabled, the signature of each kernel extension is verified before being included in the auxiliary kernel collection.
If SIP is turned off, the signature verification of a kernel extension isn’t enforced.
This approach allows Permissive Security flows for kernel developers or users who aren’t part of the Apple Developer Program to test kernel extensions before they’re signed.