macOS Kext 与有效签名在第二次安装后被拒绝( Alpine 脉)

Question

在之前安装了我的产品的机器上，由于 kext 签名拒绝，第二次安装失败。

我在某些地方看到过同样的错误，例如这里:https://support.eset.com/kb6570 ，然而，即使在恢复模式下清除 kext_policy 表，并在设置中手动批准 kext --> 下次启动时的安全性，kext 仍然似乎未获批准。

例如，运行 kextutil 提供以下内容:

Kalyan:~ KalyanPentakota$ sudo kextutil /Library/Extensions/mycompanyAT.kext/
Password:
Kext rejected due to insecure location: <OSKext 0x7f8e9ff02e20 [0x7fffa11c8af0]> { URL = "file:///Library/StagedExtensions/Library/Extensions/mycompanyAT.kext/", ID = "com.mycompany.at" }
Kext rejected due to insecure location: <OSKext 0x7f8e9ff02e20 [0x7fffa11c8af0]> { URL = "file:///Library/StagedExtensions/Library/Extensions/mycompanyAT.kext/", ID = "com.mycompany.at" }
Diagnostics for /Library/Extensions/mycompanyAT.kext:

数据库中的 kext 批准状态:

sqlite> select * from kext_policy;
XE2XNRRXZ5|jp.co.canon.bj.print.BJUSBLoad|1|Canon Inc.|8
KBVSJ83SS9|com.citrix.kext.gusb|1|Citrix Systems, Inc.|8
MK9BR98H51|com.mycompany.at|1|My Company Ltd|1

Kext 证书验证:

Kalyan:~ KalyanPentakota$ codesign -dvv /Library/Extensions/mycompanyAT.kext/
Executable=/Library/Extensions/mycompanyAT.kext/Contents/MacOS/mycompanyAT
Identifier=com.mycompany.at
Format=bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=8179 flags=0x0(none) hashes=250+3 location=embedded
Signature size=4651
Authority=Developer ID Application: My Company Ltd (MK9BR98H51)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Signed Time=Jun 5, 2018 at 6:05:21 AM
Info.plist entries=22
TeamIdentifier=MK9BR98H51
Sealed Resources version=2 rules=13 files=1
Internal requirements count=1 size=212

我也尝试删除/Library/StagedExtensions/Library/，但它也没有改变任何东西。

Answer 1

我遇到过同样的问题。

/Library/StagedExtensions 的标志必须是“受限的”:

ls -laO /Library/StagedExtensions/

drwxr-xr-x@ 4 根轮受限 2017 年 11 月 15 日 128 日 StagedExtensions

如果没有，请在恢复模式下尝试以下 cmd:

chflags -R restricted /V*/*/Library/StagedExtensions

重新启动并尝试安装 kext。