System Extensions

System Extensions

Build a system extension approval profile (com.apple.system-extension-policy) from an app or installer.

Security and networking tools often install system extensions that users must approve in System Settings. This tool finds the extensions and their Team IDs for you and builds the profile that approves them silently.

How to use it

1. Drag a .app, .systemextension or .pkg onto the window, or click Choose File…

   Use the installed .app. From a .pkg, the Team ID usually shows as Unknown and the extension type can only be guessed from the bundle ID. Only extensions the package declares in its PackageInfo are found.

2. Review what was found: each extension's name, bundle ID, Team ID and type:
   • Endpoint Security
   • Network Extension
   • Driver Extension
   • or unknown: the extension's bundle ID is still added to AllowedSystemExtensions, but no type is added for it
3. Untick any extensions you don't want to include.
4. Edit the Profile name if you like. The default is System Extensions — <source>, where <source> is the file name you dropped, with your prefix in front if you've set one. The saved file uses the same name.
5. Check the Profile payload preview, which groups extensions by Team ID.
6. Save .mobileconfig… or Upload to Jamf Pro… (see Uploading Profiles). The profile is uploaded unsigned, at Computer level, with no scope or category.

Analyse Another starts over.

What goes into the profile

One com.apple.system-extension-policy payload, with only the ticked extensions:

• AllowedSystemExtensions: Team ID → bundle IDs
• AllowedSystemExtensionTypes: Team ID → extension types (EndpointSecurityExtension, NetworkExtension, DriverExtension)

The Team ID key is the value shown in the list, so an extension with an Unknown Team ID is written under Unknown.

Where it looks

• .app: every .systemextension in Contents/Library/SystemExtensions/
• .systemextension: the extension itself
• .pkg: bundles in the package's PackageInfo whose path contains .systemextension, including nested packages. The package is read directly, without installing it or running any tools.

How it works out the details

• Team ID: read from the code signature with the macOS Security framework. It shows Unknown if the item isn't signed or the signature can't be read.

• Extension type, in this order:

  1. The EXExtensionPointIdentifier in the extension's Info.plist (endpoint-security, networkextension or driverkit).
  2. An NSEndpointSecurityMachServiceName key, which means Endpoint Security.
  3. A guess from words in the bundle ID, for example endpointsecurity, edr, vpn, tunnel, contentfilter or dext.

  A .pkg only uses the bundle ID guess.

Troubleshooting

Symptom	Fix
"… contains no system extensions."	Drop the installed .app from /Applications. Some vendors install the extension from a separate helper app, so try that app too.
Team ID shows Unknown	You probably dropped a .pkg or an unsigned bundle. Drop the installed, signed .app, or look up the Team ID in the vendor's documentation. Don't deploy a profile with Unknown as the Team ID.
Extension type is unknown	Check the vendor's documentation. If the vendor needs a specific type, confirm it's included in the preview before deploying.

Tip: use Inspector to look at a vendor's installer before and after installing it.