Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to load kext on High Sierra (10.13) #777

Closed
cmsj opened this issue Jun 13, 2017 · 19 comments
Closed

Unable to load kext on High Sierra (10.13) #777

cmsj opened this issue Jun 13, 2017 · 19 comments

Comments

@cmsj
Copy link

@cmsj cmsj commented Jun 13, 2017

Obviously High Sierra is still very early, at Developer Preview 1, but I thought I'd mention that the Karabiner Elements 0.91.1 kext is not able to be loaded:

kiryo:~ root# kextutil -v 6 /Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/
Kext user-space log filter changed from 0xff2 to 0xfff.
Kext kernel-space log filter changed from 0xff2 to 0xfff.
Kext library architecture set to x86_64.
Can't stat /AppleInternal - No such file or directory.
Defaulting to kernel file '/System/Library/Kernels/kernel'
Kext library recording diagnostics for: validation authentication dependencies warnings.
/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext appears to be loadable (not including linkage for on-disk libraries).
System policy prevents loading the kernel extension.
kiryo:~ root# 

I verified it with codesign and it appears to be fine:

kiryo:~ root# codesign --display --verbose=4 /Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/
Executable=/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/Contents/MacOS/VirtualHIDDevice
Identifier=org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600
Format=bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=1138 flags=0x0(none) hashes=29+3 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=9dab0ba54dd0ec03c72e50593e69fb75819336a7
CandidateCDHash sha256=91f95ed243acbf16c435025dd467091d428ce6b0
Hash choices=sha1,sha256
Page size=4096
CDHash=91f95ed243acbf16c435025dd467091d428ce6b0
Signature size=8959
Authority=Developer ID Application: Fumihiko Takayama (G43BCU2T37)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=25 May 2017 at 17:45:47
Info.plist entries=20
TeamIdentifier=G43BCU2T37
Sealed Resources version=2 rules=12 files=0
Internal requirements count=1 size=212
kiryo:~ root# codesign --verify --verbose=4 /Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/
/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/: valid on disk
/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/: satisfies its Designated Requirement
kiryo:~ root#

This install was upgraded from Sierra, where I was using the fork of 0.90.68 with Hyper key support, and that continued to work after the upgrade, and my Gatekeeper settings are still to allow App Store & Identified Developers.

I think the errors involved here are new, at least I haven't seen them anywhere else, and Google doesn't seem to know about them, so maybe some kind of kext policy has changed in 10.13 - except I would note that Little Snitch's kext loads fine.

@cmsj

This comment has been minimized.

Copy link
Author

@cmsj cmsj commented Jun 13, 2017

FWIW I was able to load the kext with SIP disabled (and after it has loaded once, SIP can be re-enabled)

@gretel

This comment has been minimized.

Copy link

@gretel gretel commented Jun 21, 2017

may i add my confirmation of this issue. in addition, first reboot of high sierra beta left me with the keyboard not accepting any input. figured to remove the package by using the mouse - which did remove the .kext in turn.

@jkooker

This comment has been minimized.

Copy link

@jkooker jkooker commented Jun 22, 2017

Apple just published a tech note about this. Technical Note TN2459:
Secure Kernel Extension Loading

macOS High Sierra 10.13 introduces a new feature that requires user approval before loading newly-installed third-party kernel extensions. Third-party kernel extensions (KEXTs) that were already present when upgrading to macOS High Sierra are granted automatic approval.

@gretel

This comment has been minimized.

Copy link

@gretel gretel commented Jun 26, 2017

@jkooker did fail for me as to be expected when using prereleases..

@gdbing

This comment has been minimized.

Copy link

@gdbing gdbing commented Jun 30, 2017

just installed High Sierra, and when I do a fresh install from Homebrew Cask (version 90.92) it works fine but when I update to latest beta update (91.5) the kext fails to load.

I can uninstall and reinstall, downgrading to 90.92, and it works fine until I update to 91.5 again, so its clearly a combination of the new High Sierra kext permissions and some change in Karabiner Elements between 90.92 and 91.5

@seltzered

This comment has been minimized.

Copy link

@seltzered seltzered commented Jun 30, 2017

Downgraded to 90.92 for now and it's working again (using High Sierra 10.13 Beta (17A291m)). Thanks!
The direct dmg link is: https://pqrs.org/osx/karabiner/files/Karabiner-Elements-0.90.92.dmg

@tekezo

This comment has been minimized.

Copy link
Member

@tekezo tekezo commented Jul 1, 2017

You should enable kext as @jkooker said.

@seltzered

This comment has been minimized.

Copy link

@seltzered seltzered commented Jul 1, 2017

I just tried updating from 90.92 to 91.5 while leaving the security & privacy pane open (tried something similar a few times earlier). I didn't observe a chance to 'Allow' at any point even after quitting and relaunching karabiner-elements.

This issue seems to affects multiple drivers I've had installed, though the popup warning to re-install the driver was observed:
screen shot 2017-06-30 at 7 01 08 pm

@hlouis

This comment has been minimized.

Copy link

@hlouis hlouis commented Jul 1, 2017

There is no "Allow" button appear on the Security & Privacy panel. Event I have tried launch/relaunch Karabiner or load the kext with command line.

System console log is:

Kext rejected due to system policy: <OSKext 0x7f956bd21920 [0x7fffa8c0e830]> { URL = "file:///Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/", ID = "org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600" } org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600 failed security checks; failing.

@zelphir

This comment has been minimized.

Copy link

@zelphir zelphir commented Jul 7, 2017

Getting the same issue

@NSBrianWard

This comment has been minimized.

Copy link

@NSBrianWard NSBrianWard commented Jul 16, 2017

Can confirm same issue! Downgrading KE appears to work as a stopgap.

@gdbing

This comment has been minimized.

Copy link

@gdbing gdbing commented Jul 23, 2017

update: Earlier this evening I tried updating to the latest beta (0.91.9), and the problem persisted, but after i uninstalled and did a fresh reinstall to the same version (0.91.9) it now works
i.e. i was able to unblock the kext from the security system settings pane

I tried reinstalling a dozen times before to no avail, and nothing of note is different this time ¯_(ツ)_/¯

@tekezo

This comment has been minimized.

Copy link
Member

@tekezo tekezo commented Jul 25, 2017

I added an alert into Karabiner-Elements Preferences for High Sierra in v0.91.10.
You can allow the kext easily.

170726-0001

@tekezo tekezo closed this Jul 25, 2017
@seltzered

This comment has been minimized.

Copy link

@seltzered seltzered commented Aug 7, 2017

Note: I'm just posting this here as a reference, but I've been observing that whenever updating to newer karabiner versions in high sierra beta 4 my machine will not completely boot, where under verbose mode I observe error messages such as "kextd stall", "WindowServer died". I can't quite pin this as a karabiner issue yet, but if anyone's experiencing similar you may want to file a radar and reference rdar://33527317 .

The workaround so far has been to go into recovery mode and re-install high sierra.

@dalex7777

This comment has been minimized.

Copy link

@dalex7777 dalex7777 commented Oct 6, 2017

@seltzered Thanks for posting this. I think you just helped me avoid spending a few hours reinstalling High Sierra!

@seltzered

This comment has been minimized.

Copy link

@seltzered seltzered commented Oct 6, 2017

@SimenB

This comment has been minimized.

Copy link

@SimenB SimenB commented Oct 16, 2017

@tekezo I'm unable to click the allow button, have you encountered that before? The button turns blue like it's pressed, but nothing happens. Both with and without the lock in the lower left engaged. Have tried rebooting, reinstalling as well as completely uninstall and installing from scratch.

@tekezo

This comment has been minimized.

Copy link
Member

@tekezo tekezo commented Oct 16, 2017

#1017

@luispabon

This comment has been minimized.

Copy link

@luispabon luispabon commented Jul 18, 2018

Still a thing after OSX 10.13.6 upgrade. At least change the name of the app to "Karabiner" or something so that it's instantly recognisable?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
You can’t perform that action at this time.