However, the issue with event muting lies with its lack of flexibility. Event muting allows the user to specify which data packets to omit based on certain identifiers when they subscribe to an event type at the kernel level. Solution: Two possible solutions for the bottlenecking issue are either a multi-client system or event muting. Further analysis showed that this was due to a bottleneck within the kernel messaging queue: The queue was being overloaded and data packets were being silently dropped without alerting the user. If vendors do not replace KEXTs with System Extensions, they could be jeopardizing the security of their customers’ systems.Ī few issues were encountered when experimenting with the Endpoint Security Framework:īottlenecking issue in messaging queue – An inconsistency in the data that was output was evident. This can be very difficult to achieve and is usually done solely for development purposes. Note: Although kernel extensions have been deprecated, they can still be used in modern Mac systems – but the caveat is that the security profile of the system would have to be severely degraded. It also increases the stability of the system preventing “black screens of death” (BSODs), which normally occur when third-party vendors make inaccurate memory allocations.

Because third-party access to kernel space raises several security concerns, Apple’s removal of third-party access, almost entirely, mitigates that risk. The main drivers behind Apple’s decision to remove access to the kernel space were stability and security. There are three specific frameworks that were developed as a result of Apple deprecating KEXT: In the new and improved process, the system extension works in the user space.

Macos endpoint security