How to run un-signed System Extensions in OSX catalina?

user_12312944 0
Viewed 2371

How to run un-signed System Extensions in OSX catalina?

I'm trying to load SimpleFirewall which is a system extension given by apple, ment to demonstrate packet filtering capabilities.

The project compiles, but I get this error during run:

OSSystemExtensionErrorDomain error 8

Looked it up, it means -

Invalid code signature or missing entitlements

I have SIP disabled, and turned off code signing in the xcode project.. what else can I do to have this run? I dont have a developer ID.. just testing the code..

macos-catalina macos-system-extension macos
3 Answers

As per Eskimo answer on Apple Developer Forums you might additionally to

  • disabling SIP and
  • enabling SYSX developer mode (systemextensionsctl developer on)

need to disable AMFI:

nvram boot-args="amfi_get_out_of_my_way=0x1”

This has to be done in the cmd from the Recovery Mode.

AFAIK you only need to do it, if you don't have a developer provisioning profile with com.apple.developer.endpoint-security.client entitlement.

user_4217600

Apple's Documentation on 'Debugging and Testing System Extensions' has some information on this subject.

In theory, disabling SIP should take care of the signing requirements. You may still need to sign the extension with a free Mac Developer certificate so that the entitlements can be embedded.

Are you trying to use the extension from outside an app? If so, the command

systemextensionsctl developer on

Should help.

user_486600

I have a same issue with @tuti. I am testing a hello world System Extension base on Driver Kit. I am using free developer account, Mac mini Catatila, Xcode 11 to development. In my Xcode, I setting to don't sign my code for both application and system extension. I am also disable SIP and run command "systemextensionsctl developer on". But when I load my system extension from Swift application, it still show me the log "The operation couldn’t be completed. (OSSystemExtensionErrorDomain error 8.)". When I look up the error 8, it means invalid signature. But in my computer, I can load an unsigned Kernel extension normally. So, I don't know why? I think the OS still check code signing for system extension regardless I disable SIP.

user_46446170
Related