In combination, these new frameworks are intended to provide functionality that can take the place of kernel extensions in userland. Endpoint Security Extensions, which are system extensions that make use of the EndpointSecurity Framework in system extension context.Driver Extensions, which provide developers the ability to develop drivers for USB, Serial, NIC, and HID devices.Network Extensions, which replace the Network Kernel Extension framework previously provided.The SystemExtensions framework, which is another userland framework that provides additional system functionality.This framework is meant to be a replacement for the in-kernel Kauth framework and MAC framework. The EndpointSecurity framework, which is a userland framework that can be used by any process with the correct entitlements to receive system events, as well as allow/block system events.What this means for security vendors is that those who are currently using a kernel extension to provide protection or detection will essentially need to toss out their kernel component and use the new frameworks that Apple has provided. In this post, we will go into the new EndpointSecurity and SystemExtensions frameworks.Īt WWDC 2019, Apple announced that in the upcoming macOS 10.16 release, third party vendors will no longer be allowed to run in the kernel via kernel extensions. In part 2 we covered techniques that could be used in kernel to gather even more details on system events. In part 1, we reviewed the existing kernel extension frameworks and the information that these frameworks can provide. This is the third and final post of a three-part series on understanding kernel extension frameworks for Mac systems.

Macos endpoint security