macOS Kernel & System Extensions · Lesson 8 · capstone

DriverKit & the Kext World

The last family — actual hardware drivers — and the in-kernel world they replaced. Why your Mac runs 256 kexts and not one of them is third-party.

🎯
By the end you'll know how a modern driver (DriverKit / .dext) differs from a legacy IOKit kext, see the live kext list on your own Mac, and understand the Apple-Silicon gauntlet a real kext must pass — closing the loop from Lesson 1.
256kexts loaded on your Mac right now
0of them third-party (all com.apple.*)
C++the DriverKit / IOKit language

1DriverKit: drivers, evicted from the kernel

A DriverKit driver is the fourth System Extension family. It uses the same object model as the old in-kernel IOKit — you subclass IOService, match against hardware, drive registers — but it runs as a sandboxed user-space .dext ("driver extension"). A crash kills the driver, not the Mac.

SubframeworkFor
USBDriverKitUSB devices
HIDDriverKitkeyboards, mice, game controllers
PCIDriverKitPCIe cards
SerialDriverKit / NetworkingDriverKit / AudioDriverKitserial, NICs, audio interfaces

It's C++ (a restricted dialect), and the entitlement (com.apple.developer.driverkit) is Apple-granted via the request form — like Endpoint Security, not self-service. So we cover it, but don't build it (you'd also want real hardware to drive).

2The legacy world: IOKit kexts in the kernel

Before DriverKit, every driver was a kext running inside the kernel. Look at what's loaded on your Mac — and notice who signed all of it:

▶ run me$ kextstat | wc -l 257 # 256 kexts + header line $ kextstat | grep -v com.apple | tail -n +2 | wc -l 0 # zero third-party. Every kext is Apple's own.

And a real IOKit driver object, live in the I/O Registry on your machine:

$ ioreg -p IOUSB -l | grep -E '"IOClass"|"CFBundleIdentifier"' "IOClass" = "AppleT8132USBXHCI" "CFBundleIdentifier" = "com.apple.driver.usb.AppleSynopsysUSB40XHCI"

AppleT8132USBXHCI is the USB-controller driver for your M-series chip — an IOKit class, matched to hardware, sitting in the kernel. The ioreg tree is that whole live graph of driver objects.

3Why your Mac has zero third-party kexts

It's not luck — it's policy. Apple has been deleting the KPIs kexts depend on, version by version, and steering everything to the user-space families you've spent this course on:

2019SE + DriverKit;kexts deprecated 2020Apple Silicon:AuxKC + boot policy 2021→network/USB KPIsremoved nowuser-spaceby default

4The gauntlet to load a real kext (Apple Silicon)

If you did need a genuine third-party kext, here's the price — the friction you avoided by building a System Extension instead:

GateWhat it means
Reduced SecuritySet in 1TR (hold power at boot). Even a signed third-party kext needs the boot policy dropped below Full Security + "allow kernel extensions" toggled.
Permissive Securitycsrutil disable (SIP off) for unsigned self-built kexts.
AuxKCApproved kexts are compiled into the Auxiliary Kernel Collection, which loads after the sealed Boot/System collections — so every kext change needs a reboot.
kmutilThe modern tool: kmutil load -p <path>, kmutil showloaded. (kextload/kextstat still work but shim to it.)
The whole course in one contrast

Your content filter: ./build.sh → provision → approve → running, SIP on, no reboot. A kext: recovery reboots, lowered security, AuxKC rebuild, another reboot. That is why Apple built System Extensions — and why you reframed the mission toward them.

5kext vs. dext vs. sysext

kext (legacy)DriverKit dextNE / ES sysext
Runs inkerneluser spaceuser space
Crash =kernel panicdead processdead process
LanguageC / C++C++Swift / Obj-C (ES: C)
SIPmust lowerstays onstays on
Reboot to changeyes (AuxKC)nono

6You've finished the course

What you can now do
  1. Read and interpret every System Extension on your Mac (L1) and dissect a real one's bundle/entitlements (L2).
  2. Write a content filter in Swift — app + provider (L3) — and build & sign it from the CLI (L4).
  3. Cross the entitlement gate and watch your own extension filter live traffic, SIP on (L5); update, debug, and tear it down (L6).
  4. Explain Endpoint Security and stream real ES events (L7), and place DriverKit + the kext world in context (L8).
Mission status

You set out to know the common extensions, the languages, how to build one from the ground up, and to run a CLI build and see it on your Mac. All four — done. The one remaining hands-on step is yours: provision and approve your filter from Lesson 5.

7Flashcards

dext vs kext in one line?

Both are drivers using the IOKit object model; a kext runs in the kernel (panic risk, SIP must lower, reboot to change), a DriverKit dext runs sandboxed in user space (SIP on, no reboot).

Why does changing a kext require a reboot on Apple Silicon?

Third-party kexts live in the AuxKC, which is built and loaded at boot after the sealed kernel collections. Rebuilding it needs a restart.

How do you confirm your Mac has no third-party kexts?

kextstat | grep -v com.apple → only the header line; every loaded kext is Apple-signed.

Which two families need Apple's request form, and which two are self-service?

Request form: Endpoint Security, DriverKit. Self-service: Network Extension, Camera (CMIO).

💬 Ask your teacher. Want a bonus lesson — building a real blocking filter that blocks a domain list, packaging the demo as a notarized app, or actually walking the kext gauntlet on a spare machine? I can add it. And finish Lesson 5's hands-on whenever you're ready — ping me if anything fails.