MacOS – How to identify extensions blocked by Gatekeeper

high sierrakernel-extensionsmacosmojaveSecurity

In macOS High Sierra, System Prefs > Security, it says "Some system software was blocked from loading. I see a list there of three developers, and I don't recognize all of them. I'm guessing these are kext files in /L/E or /S/L/E, but how can I identify exactly which kext corresponds to each developer name? I tried grep -rn "Intel Corporation Apps" /System/Library/Extensions but that doesn't find it.enter image description here

EDIT: Adding to this question because it was never fully answered and I have now encountered another stubborn kext I can't remove in Mojave. It appears in Disabled Software but not in System Preferences security pane.
enter image description here

I have grepped /L/E and /S/L/E and /Library/StagedExtensions and the only result I find is in /System/Library/Extensions/AppleKextExcludeList.kext/Contents/Info.plist

kextutil can't find it so where else can I look?:

# kextutil -b cn.com.bwstor.filesystems.enfs
Can't find extension with identifier cn.com.bwstor.filesystems.enfs

Best Answer

I figured it out. In System Information > Software > Disabled Software, it shows a list of these extensions with their bundle identifier. In my case, that was enough info to understand what the app is, but to locate the actual kext file requires more digging. Example:

grep -r "com.aladdin.kext.aksfridge" /Library/Extensions finds nothing.

grep -r "com.aladdin.kext.aksfridge" /Library/Application Support found it.

I'm not sure if there is a documented list of locations that are allowed to load kexts, but you could grep the whole hard drive for the bundle ID and that would surely find it.