Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Load OS X kext in the early boot process

I have a working OSX kernel extension which I would like to be automatically loaded at boot time as early as possible. The kext is using KAUTH for monitoring access on a specific path so it seems to me there won't be anything that will request it to be loaded into the kernel. In this case, copying it in /Library/Extensions (at least since Yosemite this is the recommended path for third-party extensions) won't solve my problem.

Is there a possibility to achieve this, whether or not by modifying the code or through some auxiliary configuration?

I already read about using a launchd daemon to use kextload in order to load the extension, as specified in this question, but in my case, I want it to be loaded as early as possible.

Update:
I am using a "generic" kernel extension (linked against BSD library) and not an I/O Kit based one.
I want my extension to be loaded before launchd is started.

like image 730
MathPlayer Avatar asked Apr 06 '16 08:04

MathPlayer


People also ask

What is a KEXT in Mac OS X?

Kexts, or kernel extensions, expand the basic functionality of macOS's Darwin kernel. They're analogous to drivers under Windows, and they let the kernel communicate with your computer's hardware. Most of the time, these files require no maintenance.

Which macOS security policy on a Mac with Apple Silicon lets you use kernel extensions?

On a Mac with Apple silicon, you may first need to use Startup Security Utility to set the security policy to Reduced Security and select the “Allow user management of kernel extensions from identified developers” checkbox.


1 Answers

You don't explicitly state it in the question, but I infer from the context that you're using a "generic" kernel extension (in contrast to an I/O kit based one)? These are only loaded either because another kext depends on them, or because they are explicitly loaded via kextutil/kextload or the KextManager API.

Contrast this to I/O Kit kexts, which are loaded on-demand when one of their personality dictionaries matches a registered service in the IO registry. This is usually for driving specific devices, but various non-hardware-dependent system services use the mechanism to match the 'IOResources' nub (documentation) which turns up during early boot so any kexts listing it as a provider for a personality also get loaded on boot.

So the solution would be to modify your kext to provide an IOService which matches the IOResources nub. The service itself doesn't really need to do anything if your userspace component already uses another interface to communicate with the kext.

If you don't want to change the kext's code itself, you could possibly create a dummy kext which does this, but declares your main kext as a dependency. This latter method isn't particularly elegant, but should work if for some reason modifying the existing kext is not possible. (Although you'll likely need to modify the info.plist)

like image 195
pmdj Avatar answered Oct 23 '22 05:10

pmdj