运行kextutil处理kext文件时遇权限及签名错误求助

Hey there, let's work through this kext deployment issue step by step—you're close, just a couple of missing pieces!

1. Fixing the Permission Problem #

Your initial mistake was forgetting the recursive flag when modifying permissions, which means only the top-level ssvac.kext folder got updated, not all the files and subfolders inside it. Here's how to fix it properly:

• First, set the correct owner recursively for the entire kext bundle:

  sudo chown -R root:wheel /tmp/ssvac.kext
  

• Next, ensure group and other users don't have write access (a hard requirement for macOS kexts):

  sudo chmod -R o-w /tmp/ssvac.kext
  

• Verify permissions are correct with this check:

  ls -ld /tmp/ssvac.kext && ls -l /tmp/ssvac.kext/Contents/
  

  You should see all files owned by root:wheel, with no write permissions for other (the last column should end with r-- or r-x, not rw-).

2. Resolving the "Untrusted Kexts Are Not Allowed" Error (-67050) #

Modern macOS versions (Big Sur and later) block unsigned kexts by default due to System Integrity Protection (SIP). You have a few options depending on your use case:

Option A: Temporarily Disable SIP (For Development Testing) #

This is the quickest way to test your kext, but note that it reduces system security—remember to re-enable it when you're done:

1. Restart your Mac and hold Command + R until you see the Apple logo (enter Recovery Mode).
2. Open Terminal from the Utilities menu.
3. Run this command to disable SIP:

   csrutil disable
   

4. Restart your Mac normally. You should now be able to load the unsigned kext with:

   sudo kextutil /tmp/ssvac.kext
   

5. When testing is done, repeat steps 1-3 but run csrutil enable to re-enable SIP.

Option B: Allow Kext Loading Without Full SIP Disable #

If you don't want to turn off SIP entirely, you can disable only the kext restriction:

1. Enter Recovery Mode (Command + R on restart) and open Terminal.
2. Run:

   csrutil enable --without kext
   

3. Restart your Mac. After logging in, go to System Preferences > Security & Privacy > General—you should see a prompt asking to allow the kext from your developer identity (or "unknown developer"). Click Allow.
4. Now try loading the kext again with sudo kextutil /tmp/ssvac.kext.

Option C: Sign the Kext (For Long-Term Use or Distribution) #

If you plan to use this kext regularly or share it, you'll need to sign it with an Apple Developer ID:

1. Get an Apple Developer account (required for signing kexts for macOS).
2. Generate a Developer ID Application certificate from the Apple Developer Portal.
3. Sign your kext with this certificate (replace Your Developer ID Certificate Name with your actual certificate name):

   sudo codesign -s "Your Developer ID Certificate Name" -f /tmp/ssvac.kext
   

4. Verify the signature is valid:

   codesign -vvv /tmp/ssvac.kext
   

5. You can now load the signed kext, or move it to /Library/Extensions (with sudo mv /tmp/ssvac.kext /Library/Extensions/) and run sudo kextutil /Library/Extensions/ssvac.kext.

Final Quick Tips #

• Always use cp -R when copying kext bundles to ensure all nested files are transferred correctly.
• Use kextutil -n -t /tmp/ssvac.kext to test validity without actually loading the kext—this helps catch issues before trying to deploy it.

内容的提问来源于stack exchange，提问作者dot