Unable to load kext on High Sierra (10.13) #777

Closed
cmsj opened this Issue Jun 13, 2017 · 19 comments

Comments

Projects
None yet
@cmsj

cmsj commented Jun 13, 2017

Obviously High Sierra is still very early, at Developer Preview 1, but I thought I'd mention that the Karabiner Elements 0.91.1 kext is not able to be loaded:

kiryo:~ root# kextutil -v 6 /Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/
Kext user-space log filter changed from 0xff2 to 0xfff.
Kext kernel-space log filter changed from 0xff2 to 0xfff.
Kext library architecture set to x86_64.
Can't stat /AppleInternal - No such file or directory.
Defaulting to kernel file '/System/Library/Kernels/kernel'
Kext library recording diagnostics for: validation authentication dependencies warnings.
/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext appears to be loadable (not including linkage for on-disk libraries).
System policy prevents loading the kernel extension.
kiryo:~ root# 

I verified it with codesign and it appears to be fine:

kiryo:~ root# codesign --display --verbose=4 /Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/
Executable=/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/Contents/MacOS/VirtualHIDDevice
Identifier=org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600
Format=bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=1138 flags=0x0(none) hashes=29+3 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=9dab0ba54dd0ec03c72e50593e69fb75819336a7
CandidateCDHash sha256=91f95ed243acbf16c435025dd467091d428ce6b0
Hash choices=sha1,sha256
Page size=4096
CDHash=91f95ed243acbf16c435025dd467091d428ce6b0
Signature size=8959
Authority=Developer ID Application: Fumihiko Takayama (G43BCU2T37)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=25 May 2017 at 17:45:47
Info.plist entries=20
TeamIdentifier=G43BCU2T37
Sealed Resources version=2 rules=12 files=0
Internal requirements count=1 size=212
kiryo:~ root# codesign --verify --verbose=4 /Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/
/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/: valid on disk
/Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/: satisfies its Designated Requirement
kiryo:~ root#

This install was upgraded from Sierra, where I was using the fork of 0.90.68 with Hyper key support, and that continued to work after the upgrade, and my Gatekeeper settings are still to allow App Store & Identified Developers.

I think the errors involved here are new, at least I haven't seen them anywhere else, and Google doesn't seem to know about them, so maybe some kind of kext policy has changed in 10.13 - except I would note that Little Snitch's kext loads fine.

@cmsj

This comment has been minimized.

Show comment
Hide comment
@cmsj

cmsj Jun 13, 2017

FWIW I was able to load the kext with SIP disabled (and after it has loaded once, SIP can be re-enabled)

cmsj commented Jun 13, 2017

FWIW I was able to load the kext with SIP disabled (and after it has loaded once, SIP can be re-enabled)

@gretel

This comment has been minimized.

Show comment
Hide comment
@gretel

gretel Jun 21, 2017

may i add my confirmation of this issue. in addition, first reboot of high sierra beta left me with the keyboard not accepting any input. figured to remove the package by using the mouse - which did remove the .kext in turn.

gretel commented Jun 21, 2017

may i add my confirmation of this issue. in addition, first reboot of high sierra beta left me with the keyboard not accepting any input. figured to remove the package by using the mouse - which did remove the .kext in turn.

@jkooker

This comment has been minimized.

Show comment
Hide comment
@jkooker

jkooker Jun 22, 2017

Apple just published a tech note about this. Technical Note TN2459:
Secure Kernel Extension Loading

macOS High Sierra 10.13 introduces a new feature that requires user approval before loading newly-installed third-party kernel extensions. Third-party kernel extensions (KEXTs) that were already present when upgrading to macOS High Sierra are granted automatic approval.

jkooker commented Jun 22, 2017

Apple just published a tech note about this. Technical Note TN2459:
Secure Kernel Extension Loading

macOS High Sierra 10.13 introduces a new feature that requires user approval before loading newly-installed third-party kernel extensions. Third-party kernel extensions (KEXTs) that were already present when upgrading to macOS High Sierra are granted automatic approval.

@gretel

This comment has been minimized.

Show comment
Hide comment
@gretel

gretel Jun 26, 2017

@jkooker did fail for me as to be expected when using prereleases..

gretel commented Jun 26, 2017

@jkooker did fail for me as to be expected when using prereleases..

@gdbing

This comment has been minimized.

Show comment
Hide comment
@gdbing

gdbing Jun 30, 2017

just installed High Sierra, and when I do a fresh install from Homebrew Cask (version 90.92) it works fine but when I update to latest beta update (91.5) the kext fails to load.

I can uninstall and reinstall, downgrading to 90.92, and it works fine until I update to 91.5 again, so its clearly a combination of the new High Sierra kext permissions and some change in Karabiner Elements between 90.92 and 91.5

gdbing commented Jun 30, 2017

just installed High Sierra, and when I do a fresh install from Homebrew Cask (version 90.92) it works fine but when I update to latest beta update (91.5) the kext fails to load.

I can uninstall and reinstall, downgrading to 90.92, and it works fine until I update to 91.5 again, so its clearly a combination of the new High Sierra kext permissions and some change in Karabiner Elements between 90.92 and 91.5

@seltzered

This comment has been minimized.

Show comment
Hide comment
@seltzered

seltzered Jun 30, 2017

Downgraded to 90.92 for now and it's working again (using High Sierra 10.13 Beta (17A291m)). Thanks!
The direct dmg link is: https://pqrs.org/osx/karabiner/files/Karabiner-Elements-0.90.92.dmg

Downgraded to 90.92 for now and it's working again (using High Sierra 10.13 Beta (17A291m)). Thanks!
The direct dmg link is: https://pqrs.org/osx/karabiner/files/Karabiner-Elements-0.90.92.dmg

@tekezo

This comment has been minimized.

Show comment
Hide comment
@tekezo

tekezo Jul 1, 2017

Owner

You should enable kext as @jkooker said.

Owner

tekezo commented Jul 1, 2017

You should enable kext as @jkooker said.

@seltzered

This comment has been minimized.

Show comment
Hide comment
@seltzered

seltzered Jul 1, 2017

I just tried updating from 90.92 to 91.5 while leaving the security & privacy pane open (tried something similar a few times earlier). I didn't observe a chance to 'Allow' at any point even after quitting and relaunching karabiner-elements.

This issue seems to affects multiple drivers I've had installed, though the popup warning to re-install the driver was observed:
screen shot 2017-06-30 at 7 01 08 pm

I just tried updating from 90.92 to 91.5 while leaving the security & privacy pane open (tried something similar a few times earlier). I didn't observe a chance to 'Allow' at any point even after quitting and relaunching karabiner-elements.

This issue seems to affects multiple drivers I've had installed, though the popup warning to re-install the driver was observed:
screen shot 2017-06-30 at 7 01 08 pm

@hlouis

This comment has been minimized.

Show comment
Hide comment
@hlouis

hlouis Jul 1, 2017

There is no "Allow" button appear on the Security & Privacy panel. Event I have tried launch/relaunch Karabiner or load the kext with command line.

System console log is:

Kext rejected due to system policy: <OSKext 0x7f956bd21920 [0x7fffa8c0e830]> { URL = "file:///Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/", ID = "org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600" } org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600 failed security checks; failing.

hlouis commented Jul 1, 2017

There is no "Allow" button appear on the Security & Privacy panel. Event I have tried launch/relaunch Karabiner or load the kext with command line.

System console log is:

Kext rejected due to system policy: <OSKext 0x7f956bd21920 [0x7fffa8c0e830]> { URL = "file:///Library/Extensions/org.pqrs.driver.Karabiner.VirtualHIDDevice.kext/", ID = "org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600" } org.pqrs.driver.Karabiner.VirtualHIDDevice.v040600 failed security checks; failing.

@zelphir

This comment has been minimized.

Show comment
Hide comment
@zelphir

zelphir Jul 7, 2017

Getting the same issue

zelphir commented Jul 7, 2017

Getting the same issue

@NSBrianWard

This comment has been minimized.

Show comment
Hide comment
@NSBrianWard

NSBrianWard Jul 16, 2017

Can confirm same issue! Downgrading KE appears to work as a stopgap.

NSBrianWard commented Jul 16, 2017

Can confirm same issue! Downgrading KE appears to work as a stopgap.

@gdbing

This comment has been minimized.

Show comment
Hide comment
@gdbing

gdbing Jul 23, 2017

update: Earlier this evening I tried updating to the latest beta (0.91.9), and the problem persisted, but after i uninstalled and did a fresh reinstall to the same version (0.91.9) it now works
i.e. i was able to unblock the kext from the security system settings pane

I tried reinstalling a dozen times before to no avail, and nothing of note is different this time ¯_(ツ)_/¯

gdbing commented Jul 23, 2017

update: Earlier this evening I tried updating to the latest beta (0.91.9), and the problem persisted, but after i uninstalled and did a fresh reinstall to the same version (0.91.9) it now works
i.e. i was able to unblock the kext from the security system settings pane

I tried reinstalling a dozen times before to no avail, and nothing of note is different this time ¯_(ツ)_/¯

@tekezo

This comment has been minimized.

Show comment
Hide comment
@tekezo

tekezo Jul 25, 2017

Owner

I added an alert into Karabiner-Elements Preferences for High Sierra in v0.91.10.
You can allow the kext easily.

170726-0001

Owner

tekezo commented Jul 25, 2017

I added an alert into Karabiner-Elements Preferences for High Sierra in v0.91.10.
You can allow the kext easily.

170726-0001

@tekezo tekezo closed this Jul 25, 2017

@seltzered

This comment has been minimized.

Show comment
Hide comment
@seltzered

seltzered Aug 7, 2017

Note: I'm just posting this here as a reference, but I've been observing that whenever updating to newer karabiner versions in high sierra beta 4 my machine will not completely boot, where under verbose mode I observe error messages such as "kextd stall", "WindowServer died". I can't quite pin this as a karabiner issue yet, but if anyone's experiencing similar you may want to file a radar and reference rdar://33527317 .

The workaround so far has been to go into recovery mode and re-install high sierra.

seltzered commented Aug 7, 2017

Note: I'm just posting this here as a reference, but I've been observing that whenever updating to newer karabiner versions in high sierra beta 4 my machine will not completely boot, where under verbose mode I observe error messages such as "kextd stall", "WindowServer died". I can't quite pin this as a karabiner issue yet, but if anyone's experiencing similar you may want to file a radar and reference rdar://33527317 .

The workaround so far has been to go into recovery mode and re-install high sierra.

@dalex7777

This comment has been minimized.

Show comment
Hide comment
@dalex7777

dalex7777 Oct 6, 2017

@seltzered Thanks for posting this. I think you just helped me avoid spending a few hours reinstalling High Sierra!

@seltzered Thanks for posting this. I think you just helped me avoid spending a few hours reinstalling High Sierra!

@seltzered

This comment has been minimized.

Show comment
Hide comment
@seltzered

seltzered Oct 6, 2017

@SimenB

This comment has been minimized.

Show comment
Hide comment
@SimenB

SimenB Oct 16, 2017

@tekezo I'm unable to click the allow button, have you encountered that before? The button turns blue like it's pressed, but nothing happens. Both with and without the lock in the lower left engaged. Have tried rebooting, reinstalling as well as completely uninstall and installing from scratch.

SimenB commented Oct 16, 2017

@tekezo I'm unable to click the allow button, have you encountered that before? The button turns blue like it's pressed, but nothing happens. Both with and without the lock in the lower left engaged. Have tried rebooting, reinstalling as well as completely uninstall and installing from scratch.

@tekezo

This comment has been minimized.

Show comment
Hide comment
Owner

tekezo commented Oct 16, 2017

#1017

@nodeful nodeful referenced this issue in nodeful/eqMac2 Oct 20, 2017

Closed

Crashes on install/launch - macOS 10.13 #66

@ydakuka ydakuka referenced this issue in zerotier/ZeroTierOne May 24, 2018

Closed

PORT_ERROR After Upgrade to v1.2.2 #467

@luispabon

This comment has been minimized.

Show comment
Hide comment
@luispabon

luispabon Jul 18, 2018

Still a thing after OSX 10.13.6 upgrade. At least change the name of the app to "Karabiner" or something so that it's instantly recognisable?

Still a thing after OSX 10.13.6 upgrade. At least change the name of the app to "Karabiner" or something so that it's instantly recognisable?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment