MacOS – How to remove all traces of a kext

kernelkernel-extensionsmacosmojave

I am trying to fully remove a kernel extension which I installed by mistake, and I can't figure out how to remove it from the Disabled Software list. It appears in System Profiler and also in System Preferences security pane.

enter image description here

I have grepped /L/E and /S/L/E and /Library/StagedExtensions and the only result I find is in /System/Library/Extensions/AppleKextExcludeList.kext/Contents/Info.plist

kextutil can't find it:

# kextutil -b cn.com.bwstor.filesystems.enfs
Can't find extension with identifier cn.com.bwstor.filesystems.enfs

Apparently it's in the prelinked kernel:

$ grep -rni bwstor /System/Library/PrelinkedKernels/
Binary file /System/Library/PrelinkedKernels//prelinkedkernel matches
Binary file /System/Library/PrelinkedKernels//immutablekernel matches

So I try to rebuild like this:

# kextcache -system-prelinked-kernel
KernelCache ID: 589C15EF68C8CF9D1C456F8C5E809F74
#
# kextcache -prelinked-kernel
kxld[com.apple.kext.AMDRadeonX6000HWLibs]: The following symbols are unresolved for this kext:
kxld[com.apple.kext.AMDRadeonX6000HWLibs]:  AtiPowerPlayInterface::createPowerPlayServiceFor(PowerPlayCallbacks*)
Link failed (error code 5).
Prelink failed for com.apple.kext.AMDRadeonX6000HWLibs; omitting from prelinked kernel.
KernelCache ID: B8572AE0865E63FD3CE5E2A9014CEA6A

That error seems unrelated, but I get more details anyway:

# kextutil -b com.apple.kext.AMDRadeonX6000HWLibs
Disabling KextAudit: SIP is off
(kernel) kxld[com.apple.kext.AMDRadeonX6000HWLibs]: The following symbols are unresolved for this kext:
(kernel) kxld[com.apple.kext.AMDRadeonX6000HWLibs]:     __ZN21AtiPowerPlayInterface25createPowerPlayServiceForEP18PowerPlayCallbacks
(kernel) Can't load kext com.apple.kext.AMDRadeonX6000HWLibs - link failed.
(kernel) Failed to load executable for kext com.apple.kext.AMDRadeonX6000HWLibs.
(kernel) Kext com.apple.kext.AMDRadeonX6000HWLibs failed to load (0xdc008016).
(kernel) Failed to load kext com.apple.kext.AMDRadeonX6000HWLibs (error 0xdc008016).
Failed to load /System/Library/Extensions/AMDRadeonX6000HWServices.kext/Contents/PlugIns/AMDRadeonX6000HWLibs.kext - (libkern/kext) link error.
Check library declarations for your kext with kextlibs(8).
#
# kextlibs -undef-symbols /System/Library/Extensions/AMDRadeonX6000HWServices.kext/Contents/PlugIns/AMDRadeonX6000HWLibs.kext/
For all architectures:
    com.apple.iokit.IOPCIFamily = 2.9
    com.apple.kext.AMDRadeonX4000HWLibs = 1.0
    com.apple.kext.AMDRadeonX4030HWLibs = 1.0
    com.apple.kext.AMDRadeonX4050HWLibs = 1.0
    com.apple.kext.AMDRadeonX4070HWLibs = 1.0
    com.apple.kext.AMDRadeonX4100HWLibs = 1.0
    com.apple.kext.AMDRadeonX4200HWLibs = 1.0
    com.apple.kext.AMDRadeonX4300HWLibs = 1.0
    com.apple.kext.AMDRadeonX4400HWLibs = 1.0
    com.apple.kext.AMDRadeonX5000HWLibs = 1.0
    com.apple.kext.AMDRadeonX5100HWLibs = 1.0
    com.apple.kext.AMDRadeonX5400HWLibs = 1.0
    com.apple.kext.AMDRadeonX5700HWLibs = 1.0
    com.apple.kpi.iokit = 18.2
    com.apple.kpi.libkern = 18.2
    com.apple.kpi.mach = 18.2

For x86_64:
    Multiple symbols found among 1 libraries:
    com.apple.kext.AMDRadeonX5000HWLibs

I'm puzzled as to why rebuilding the kernel cache doesn't fix this. I'm running Mojave 10.14.3 on a MacPro6,1. I have SIP disabled and I'm using @goalque's patch to use an external Radeon Vega64 GPU.

Best Answer

The latter half of my question turned out to be a red herring. I ran the same grep on another system which has never had this driver installed and it also appears in the prelinked kernel there.

Anyway, the list of Disabled Software is stored in a SQLite database located at /private/var/db/SystemPolicyConfiguration/KextPolicy. This file is protected by SIP, so modifying it requires either disabling SIP or booting Recovery mode. In this case I deleted the entries with this command, and it takes effect immediately.

# sqlite3 /private/var/db/SystemPolicyConfiguration/KextPolicy

To see all the entries of approved and unapproved kexts:

SELECT * FROM kext_policy;

To delete:

DELETE FROM kext_policy WHERE team_id = 'JS776ETM39';
Related Question