3

So I'm building a macOS app with a Network Extension in Swift. After some tests, the extension remains as a process in the system. I can stop and also I can kill the app but I cannot stop, kill or unload the Network Extension. The Network Extension emerges again and again.

I restarted macOS but the Network Extension is still there as a process. How can I completely remove it from the System?

pmdj
  • 22,018
  • 3
  • 52
  • 103
Jan
  • 127
  • 2
  • 8

1 Answers1

6

You should be able to remove it by one of the following 2 methods:

  • Delete the host application from /Applications using the Finder. This should prompt you that it will remove any associated system extensions. (May not work if you've disabled the requirement for host apps residing in /Applications on your system. This is done using the systemextensionsctl developer on terminal command)
  • Submit an extension deactivation request created using the +deactivationRequestForExtension:queue: method on OSSystemExtensionRequest. This is the complement of the activation request you used to install the extension in the first place.
pmdj
  • 22,018
  • 3
  • 52
  • 103
  • 2
    You may also use 'systemextensionsctl uninstall [teamid] [bundleid]' in terminal for the first point. Use 'systemextensionsctl list' to view current enabled system extensions. – DemetriOS Jun 21 '20 at 12:32
  • 1
    You may need to run `csrutil disable` in Recovery mode terminal before you can uninstall with `systemextensionsctl uninstall`. Don't forget to turn on SIP (System Integrity Protection) again with `csrutil enable`. – rmalviya Sep 17 '20 at 07:22
  • @rmalviya Uninstalling and rebooting without disabling SIP should also work, but the mechanism has certainly been buggy in some OS versions. 10.15.6 seems reliable though. In the worst case, you can disable SIP, delete the extension from `/Library/SystemExtensions/`, edit the file `/Library/SystemExtensions/db.plist` to remove the extension from there too, then reboot, and then re-enable SIP. – pmdj Sep 17 '20 at 09:45
  • 1
    In macOS Catalina v10.15.6, `systemextensionsctl` produces following output: `At this time, this tool cannot be used if System Integrity Protection is enabled. This limitation will be removed in the near future. Please remember to re-enable System Integrity Protection!` – rmalviya Sep 17 '20 at 13:58
  • Removing the install folder from `/Applications` will not remove the system extension on Monterey. I banged my head against the wall over this bc my test extension would not update between test iterations. In order to replace it the version number has to be higher, and as @rmalviya said...`systemextensionsctl` will not work unless you disable SIP – spartygw Apr 21 '22 at 23:51
  • @pmdj. Hi, I was wondering if there's a way to catch the deactivation request `+deactivationRequestForExtension:queue:` in the extension side and decide whether to approve/discard the operation. Perhaps there's a way to prevent the deactivation in some circumstances from the extension side? thanks ! – Zohar81 Apr 02 '23 at 12:20
  • @Zohar81 I'm not aware of any such facility. You may be able achieve it via an Endpoint Security system extension, but I don't have much practical experience with those. – pmdj Apr 02 '23 at 12:45