How to configure System Extensions on macOS devices

The system extension policy for macOS devices allows applications and installers that use system extensions to load on your end users’ devices. Like kernel extensions, system extensions allow installing app extensions that can extend the native capabilities of the OS. Applying the Hexnode System Extension policy on a Mac with a system extension in the pending state ensures successful activation of the extension. Likewise, removing a system extension policy deactivates the extensions that were enabled through that policy.

What are System Extensions?

System extensions, a modern alternative for Kernel extensions, allow developers to create apps with enhanced functionalities without giving kernel-level access to the system. Prior to macOS Catalina, app developers were allowed to code directly into the macOS kernel to create apps. Even though it offers an opportunity to create apps with advanced functionalities, it has the potential to compromise the stability and security of the Mac. Since Kernel extension (KEXT) possesses Kernel-level control, any actions taken by the KEXT are prioritized over all other system functions. So, if the KEXT contains even a minor bug, this might lead to kernel panics or unpredicted behaviors. Nonetheless, Kernel extensions are not restrained by macOS security policies, so if it is vulnerable, not only the app but the whole system will be at risk.

Enabling kernel-level access for individual apps opens a portal to security and operation vulnerabilities as the kernel is in charge of everything on the system. On the contrary, System extensions are developed in the user space of the Mac instead of the kernel. They are therefore bound to obey the system security policies, thereby improving the stability of the system. So, if the extension has any security vulnerabilities, it only affects the app and not the system. Also, these extensions are granted high-level privileges and can perform tasks that were previously reserved for KEXTs. With the introduction of macOS Catalina, Apple has deprecated the use of certain kernel extensions and replaced them with system extensions. Additionally, with System Extensions, developers are free to write code in any programming language as opposed to C and C++. System Extensions render increased stability for the system without lacking power.

To replace KEXTs, three types of system extension frameworks are available:

• Driverkit – The Driverkit framework defines the fundamental structure of the driver and offers support for event handling and memory allocation. It’s used to make USB, serial, network interface, and human interface device drivers that users can install on macOS.
• Network extension – You can customize and expand core network functionality using network extension framework, such as configuring Wi-Fi and VPN, establishing an on-device content filter, also creating and managing system-wide DNS configuration.
• Endpoint security extension – Endpoint security is an API that is primarily used by antivirus software to monitor system events for potentially malicious activity. It even blocks system events to ensure macOS security standards are followed.

These extensions are to be packed inside the app bundle and are installed on the system during runtime. You will have to remove the app to delete or disable the extension.

Configure Mac System Extension Settings

1. Navigate to the Policies tab on your Hexnode portal.
2. Choose an existing policy or create a new policy by clicking on New Policy.
3. Provide a suitable name for the policy if the ‘New Policy’ option is chosen.
4. Select System Extensions from macOS > Configurations.
5. Click on Configure and specify the System Extensions settings.
6. Click Save.

You’ll have the following options to be configured.

User Override

Check this box to allow users to approve additional system extensions to load, other than those specified in the policy.

Team Identifiers

Enter the Team identifiers of validly signed system extensions that should be allowed to load on the Mac. The team identifier must be alphanumeric and should have 10 characters.

System Extensions

List the specific System extension that you want to approve for the Mac.

Add the Bundle identifier and Team identifier of a system extension to load. For unsigned system extensions, leave the field empty.

Or

You can also upload a file containing a list of system extensions that you want to approve for the Mac in either .plist or .xml format.

To upload a file,

1. Click on Choose and select the required file or upload a new file.
2. After selecting the file, click on OK to add the file.

System Extension types

This option will let you choose specific types of System Extensions that are allowed to be installed for the team identifier. You can enable the following System Extensions for each team ID: Endpoint Security Extension, Driver Extension, and Network Extension.

Note that all extension types will be allowed by default if you haven’t specified the extension type for a given team ID.

Removable System Extension

Add the Bundle identifier and Team identifier of a system extension to load. For unsigned system extensions, leave the field empty.

Or

You can also upload a file containing a list of system extensions in either .plist or .xml format. Make sure you select files that do not have any conflicting configurations.

To upload a file,

1. Click on Choose and select the required file or upload a new file.
2. After selecting the file, click on OK to add the file.

Associate target entities

If you haven’t saved your policy,

1. Navigate to Policy Targets.
2. Select the devices, devices groups, users, user groups or domains you wish to associate the policy with.
3. Click Save.

If you have saved your policy,

1. Navigate to Policies.
2. Search and select the policy you wish to associate with the devices.
3. Click Manage > Associate Targets.
4. Select the devices, devices groups, users, user groups or domains you wish to associate the policy with.
5. Click on Associate.

Identify system and kernel extensions

If you are unsure whether the software use system or kernel extension, either contact the software manufacturer to find out, or run a command in the terminal after installing the software.

systemextensionsctl list

If this renders the following output, the software leverages kernel extension (that is, no system extensions). Else the software details like the bundle ID and the team ID will be displayed.

systemextensionsctl list

0 extension(s)