macOS High Sierra 10.13 introduced a new security feature that requires manual user approval before loading new third-party kernel extensions.
- MAC OS Security Permissions notification regarding system software from 'Matt Ingalls' was blocked from loading ← Audio The Hindenburg Journalist PRO, Broadcaster and Educator installer for Mac OS includes the program called 'Soundflower', that you would need to route Skype and other external audio programs to Hindenburg if you are not using.
- May 26, 2019 Important Information. This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to.
- (The 'System software developer' in the blocked-by-red area will be 'Jonathan Bullard' for Tunnelblick kexts.) If the user doesn't grant approval within 30 minutes, the ability to approve the kext disappears and will only reappear after trying to connect the VPN again.
- This feature enforces that only kernel extensions approved by the user will be loaded on a system. When a request is made to load a KEXT that the user has not yet approved, the load request is denied and macOS presents the alert shown in Figure 1. Figure 1 Blocked kernel extension.
Note: The macOS alert message shows the name of the developer who signed the KEXT, which comes from the Subject Common Name field of the Developer ID Application certificate used to sign the KEXT. When installing a software on High Sierra you may receive an alert message “System Extension Blocked” see image below.
User Approved Kernel Extension Loading
To improve security on the Mac, kernel extensions installed with or after the installation of macOS High Sierra require user consent in order to load. This is known as User Approved Kernel Extension Loading. Any user can approve a kernel extension, even if they don’t have administrator privileges.
A walk-through of the user approval process
When a user installs an application on a Mac (either from a local source or via Managed Software Center) which loads a third-party extension, the load request is denied and macOS presents the alert shown in Figure 1.
System Software From Developer Was Blocked From Loading Machines
Figure 1 — The 'System Extension Blocked' dialog which you would see if you have installed the GlobalProtect VPN application for the first time.
Click on the button labeled 'Open Security Preferences', which will take you to the Security & Privacy panel of Systems Preferences (as shown in Figure 2).
System Software From Developer Was Blocked From Loading Machine
NOTE: If you click the 'OK' button instead, you have 30 minutes in which to navigate to the Security & Privacy System Preference before the Allow button disappears. You would then need to restart the Mac in order to approve the system extension(s).
Figure 2— User approval to load the third-party extension. In this example, selecting 'Allow' will enable loading of kernel extensions from Palo Alto Networks, developers of the GlobalProtect VPN client.
Click on the 'Allow' button to enable the kernel extension to load so that this application (and any other applications by the same developer) will function properly on the Mac. You will be prompted if a restart is required at this time.
Which applications require user approval?
Below is a short list of the third-party applications you would be most likely to encounter at WCER which may require manual approval:
• Box Drive (cloud storage and collaboration application)
• Cisco System's AMP for Endpoints Connector (antivirus and malware protection)
• Palo Alto Networks GlobalProtect (VPN client)
System Software From Developer Was Blocked From Loading Mac Computer
• VMWare Fusion (virtual machine application)
System Software From Developer Was Blocked From Loading Macbook Pro
Macos System Software From Developer Was Blocked From Loading
PLEASE NOTE:If any of these applications were already installed when you received your Mac, then the Tech Services administrator would have already approved them so you should not be prompted for approval.