macOS kext with invalid signature

macos code-signing signing kernel-extension
mafgani picture mafgani · Oct 5, 2018 · Viewed 8.4k times · Source

We have a kext-enabled Developer ID which we are using for code signing and I have verified that the certificate contains the 1.2.840.113635.100.6.1.18 extension required. However, kextutil -tn still shows:

Untrusted kexts are not allowed  
Kext with invalid signature (-67050) denied: /Library/StagedExtensions/Library/Extensions/A0587A5A-52FC-46DC-832E-81919195902C.kext

After signing, I re-extracted the signature using 'codesign -d --extract-certificates' to verify that the correct kext-enabled Developer ID certificate was indeed used during the signing process.

I have "Apple Worldwide Developer Relations Certification Authority" and "Developer ID Certification Authority" certs in both the login and System keychains.

Any suggestions on where to go from here? Thanks!

Answer

mafgani picture mafgani · Oct 6, 2018

I've figured it out. Turns out macOS 10.13+ denies kexts by default -- even those signed with a valid kex-enabled Dev. ID certificate (which we have). The solution is described in this tech note (and alluded to in the comments above):

https://developer.apple.com/library/archive/technotes/tn2459/_index.html

The first time an attempt is made to load the kext, macOS should present the user with a popup informing them that it was blocked. The user then needs to go to System Preferences > Security & Privacy in order to approve the kext. Note that the approval needs to happen within 30 minutes of the load attempt or it will disappear. Subsequent load attempts will be rejected silently but will reactivate the prompt within "Security & Privacy" -- giving the user another chance to approve the kext.

$ csrutil status
System Integrity Protection status: enabled.

$ sudo kextutil -v /Users/xxx.yyy/Library/Developer/Xcode/DerivedData/zzzz-dvqiwdodghcxydamtmpmffakjyrt/Build/Products/Release/zzzz.kext
Defaulting to kernel file '/System/Library/Kernels/kernel'
/Users/xxx.yyy/Library/Developer/Xcode/DerivedData/zzzz-dvqiwdodghcxydamtmpmffakjyrt/Build/Products/Release/zzzz.kext appears to be loadable (not including linkage for on-disk libraries).
Loading /Users/xxx.yyy/Library/Developer/Xcode/DerivedData/zzzz-dvqiwdodghcxydamtmpmffakjyrt/Build/Products/Release/zzzz.kext.
/Users/xxx.yyy/Library/Developer/Xcode/DerivedData/zzzz-dvqiwdodghcxydamtmpmffakjyrt/Build/Products/Release/zzzz.kext successfully loaded (or already loaded).

$ kextstat | grep xxxxxx
161    0 0xffffff7f83af6000 0x3c9000   0x3c9000   com.xxxxxx.driver.zzzz (1) 230E04D6-5C15-373F-8F73-E23566AE3C22 <22 15 5 4 3 1>

Related questions

"User interaction is not allowed" trying to sign an OSX app using codesign

Our automated build is running on Jenkins. The build itself is running on slaves, with the slaves being executed via SSH. I get an error: 00:03:25.113 [codesign-app] build/App.app: User interaction is not allowed. I have tried every suggestion I …

Read More
Xcode 5: Code signing entitlement errors

I've build a new application which is going to support IOS 7. I got the new XCode 5 GM and tried to sign my apps using my fresh provisioning profile and distribution certificate, but i'm having trouble with distribution. I constantly get …

Read More
codesign gives always no identity found error via terminal

I've looked through already existing questions, but none has solved my problems (like recreating certificates). I've built an app where inside the app I have few executables and folders and frameworks. Whenever I try to do codesign -s "our identity" …

Read More