Glossary

The two worlds

KEXT legacy

Kernel Extension. A bundle of code (.kext) loaded into the kernel's own address space, running with full kernel privileges. A bug or crash takes down the whole machine (a kernel panic). The classic way to add drivers, filesystems, network filters. Deprecated by Apple since 2019.

System Extension modern

A third-party extension that runs in user space as a sandboxed process, not in the kernel. Replaces most kext use-cases. A crash kills only that process, not the OS. Managed by the user via System Settings → Login Items & Extensions. Categories: Network, Endpoint Security, Driver (DriverKit), Camera (CMIO).

DriverKit / DEXT modern

The framework + runtime for writing device drivers in user space. A built driver is a .dext ("driver extension"). It's the user-space successor to IOKit C++ kext drivers — same object model, but isolated from the kernel. Subframeworks: USBDriverKit, HIDDriverKit, PCIDriverKit, SerialDriverKit, NetworkingDriverKit, AudioDriverKit, SCSIControllerDriverKit.

IOKit legacy

Apple's object-oriented (C++ subset) framework for writing drivers inside the kernel. Most hardware kexts are IOKit drivers subclassing IOService. DriverKit is its modern, user-space mirror.

KPI legacy

Kernel Programming Interface. The set of kernel symbols/APIs a kext is allowed to link against. Apple has been removing whole KPI families (networking, USB) version by version — when the KPI is gone, the kext category is dead, forcing migration.

The modern frameworks (what kexts became)

NetworkExtension modern

User-space framework for VPNs, content filters, DNS proxies, packet tunnels. Replaces socket filter / network filter kexts (sflt_*, ipf_*). Your Tailscale extension is one of these.

EndpointSecurity modern

User-space API for security tools (EDR/antivirus/DLP) to observe and authorize system events (process exec, file open, etc.). Replaces KAUTH (kauth_*) kexts. Requires a special Apple-granted entitlement. Your Mac Monitor extension is one of these.

Apple Silicon security gates

SIP

System Integrity Protection. Kernel-enforced policy that, among other things, requires kexts to be properly signed before loading. Enabled by default (and on your Mac). With SIP on, kext signatures are verified before inclusion in the AuxKC; with SIP off, signatures aren't enforced — which is how unsigned, self-built kexts get loaded for testing.

Reduced Security

An Apple Silicon boot-policy tier (set in recoveryOS) below "Full Security." Required even to load signed, identified-developer third-party kexts. Includes the toggle "Allow user management of kernel extensions from identified developers."

Permissive Security

The lowest Apple Silicon tier, reached by disabling SIP (csrutil disable) from recovery. Lets developers not in the Apple Developer Program load unsigned kexts for testing. Needed for a from-scratch self-signed "hello world" kext.

1TR term

One True Recovery. The trusted recovery environment entered by holding the power button at startup on Apple Silicon (not ⌘-R). Security-policy changes (Reduced/Permissive) can only be made from 1TR.

AuxKC

Auxiliary Kernel Collection. On Apple Silicon, approved third-party kexts are compiled into this collection, which loads after the sealed Boot/System kernel collections. It only takes effect after a reboot — which is why kext changes always require restarting.

CLI tools

kmutil tool

The modern kext manager (macOS 11+). Subcommands: kmutil showloaded (list loaded kexts), kmutil load -p <path>, kmutil inspect, kmutil create (build a kernel collection). Replaced the family below.

kextstat / kextload / kextunload tool

The deprecated trio for listing/loading/unloading kexts. They still exist but now shim to kmutil under the hood. You'll see them in old tutorials.

systemextensionsctl tool

CLI for the modern world: systemextensionsctl list shows installed System Extensions; developer on enables loading unsigned/dev-built extensions. The user-space counterpart to kmutil showloaded.

ioreg tool

Dumps the live I/O Registry — the runtime tree of IOKit driver objects. Use it to confirm a driver attached to a device.

log stream / log show tool

The unified-logging CLI. sudo log stream --predicate '...' is how you watch a kext/extension print messages in real time — the "see it running" step. (Replaced the old dmesg workflow.)

Packaging & signing

Mach-O

The executable binary format on macOS. A kext's compiled code is a Mach-O bundle; the kernel itself is a Mach-O.

Team ID / Developer ID

Your Apple Developer signing identity. Third-party kexts must be signed with a Developer ID that carries Apple's special Kernel Extension signing capability; DriverKit/EndpointSecurity need Apple-granted entitlements. The Team ID is the 10-char code shown in systemextensionsctl list (e.g. Tailscale's W5364U7YZB).

Entitlement

A signed capability baked into a binary that grants access to a restricted API. DriverKit, EndpointSecurity, and NetworkExtension all require specific entitlements that Apple must approve for your developer account.