New macOS 10.15.4 warnings are a shot across the bow for kernel extensions

By Oliver Haslam
published

macOS Catalina
macOS Catalina (Image credit: iMore)

What you need to know

  • macOS 10.15 Catalina is the last big release to support kernel extensions.
  • Apple is now warning users if they have one installed.
  • The warnings started after installing macOS 10.15.4.

Back at WWDC 2019, Apple warned developers that it was going to deprecate macOS kernel extensions in an attempt to make the Mac more stable, more secure, and just more modern. With the release of macOS 10.15.4, Apple has now started to warn users (opens in new tab) that they're running a "legacy" extension, too.

Apple is replacing kernel extensions with system extensions and it wants developers to ditch the former as soon as possible. So much so that it's naming and shaming extensions as of the recent update as spotted by Rich Trouton and Stephen Hacket.

Legacy System Extension Catalina Alert

Legacy System Extension Catalina Alert (Image credit: Rich Trouton)

As part of macOS Catalina 10.15.4, Apple has begun displaying a new dialog window message concerning third-party kernel extensions. macOS Catalina is the last macOS to fully support the use of kernel extensions and these messages are meant to notify users of the following:

  • macOS had detected that a third-party kernel extension had been loaded.
  • The loaded kernel extension would be incompatible with an unspecified future version of macOS

Apple outlines its plans to kill off kernel extensions on its developer website (opens in new tab), saying that future OS releases will ditch support entirely.

System extensions on macOS Catalina (10.15) allow software like network extensions and endpoint security solutions to extend the functionality of macOS without requiring kernel-level access. At WWDC19, we announced the deprecation of kernel extensions as part of our ongoing effort to modernize the platform, improve security and reliability, and enable more user-friendly distribution methods. Kernel programming interfaces (KPIs) will be deprecated as alternatives become available, and future OS releases will no longer load kernel extensions that use deprecated KPIs by default.

While Apple says that it hasn't yet set a final transition date, it's probably just a few months away. Thankfully this won't impact the majority of people – kernel extensions tend to be used most frequently in the enterprise, specifically to enable encryption, networking, and antivirus software to function.

Oliver Haslam
Oliver Haslam
Contributor

Oliver Haslam has written about Apple and the wider technology business for more than a decade with bylines on How-To Geek, PC Mag, iDownloadBlog, and many more. He has also been published in print for Macworld, including cover stories. At iMore, Oliver is involved in daily news coverage and, not being short of opinions, has been known to 'explain' those thoughts in more detail, too.

Having grown up using PCs and spending far too much money on graphics card and flashy RAM, Oliver switched to the Mac with a G5 iMac and hasn't looked back. Since then he's seen the growth of the smartphone world, backed by iPhone, and new product categories come and go. Current expertise includes iOS, macOS, streaming services, and pretty much anything that has a battery or plugs into a wall. Oliver also covers mobile gaming for iMore, with Apple Arcade a particular focus. He's been gaming since the Atari 2600 days and still struggles to comprehend the fact he can play console quality titles on his pocket computer.

3 Comments
  • This is a great thing, there's so many poorly made kernel extensions and once these go wrong they take down your whole system. This is a big step forward
  • From what I’m reading this may also mean curtains for the Hackintosh crowd.
  • While it's true that Hackintosh often makes use of kernel extensions (kext files), it's called "Hack"intosh for a reason, they will most likely just find another way around it, like the jailbreak team does for iOS.