{"id":20010,"date":"2018-01-02T16:00:33","date_gmt":"2018-01-02T21:00:33","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=20010"},"modified":"2018-01-03T10:26:48","modified_gmt":"2018-01-03T15:26:48","slug":"the-app-you-cant-trash-how-sip-is-broken-in-high-sierra","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2018\/01\/02\/the-app-you-cant-trash-how-sip-is-broken-in-high-sierra\/","title":{"rendered":"The &ldquo;app&rdquo; You Can&rsquo;t Trash: How SIP Is Broken in High Sierra"},"content":{"rendered":"<p><a href=\"https:\/\/eclecticlight.co\/2018\/01\/02\/the-app-you-cant-trash-how-sip-is-broken-in-high-sierra\/\">Howard Oakley<\/a>:<\/p>\n<blockquote cite=\"https:\/\/eclecticlight.co\/2018\/01\/02\/the-app-you-cant-trash-how-sip-is-broken-in-high-sierra\/\">\n<p>So how did this third-party kernel extension end up in this mysterious folder, complete with SIP protection? Surely SIP is there to protect macOS, not third-party app components installed later by the user? Who or what enabled SIP on that extension, and how can it be removed?<\/p>\n<p>[&#8230;]<\/p>\n<p>High Sierra has a new mechanism for handling third-party kernel extensions (User-Approved Kernel Extension Loading, or UAKL), which requires the user to authorise them. When a third-party installer tries to install a kernel extension, you see the warning[&#8230;] High Sierra then packages the extension in the form of a non-executable stub app, which it installs in \/Library\/StagedExtensions\/Applications.<\/p>\n<p>[&#8230;]<\/p>\n<p>Thus SIP prevents the user from uninstalling a third-party app which the user installed, even though the kernel extension might be rendering macOS unstable, or have other significant side-effects.<\/p>\n<\/blockquote>\n\n<p>Previously: <a href=\"https:\/\/mjtsai.com\/blog\/2017\/09\/15\/kernel-extensions-in-high-sierra\/\">Kernel Extensions in High Sierra<\/a>.<\/p>\n\n<p>Update (2018-01-03): See also: <a href=\"https:\/\/news.ycombinator.com\/item?id=16059402\">Hacker News<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>Howard Oakley: So how did this third-party kernel extension end up in this mysterious folder, complete with SIP protection? Surely SIP is there to protect macOS, not third-party app components installed later by the user? Who or what enabled SIP on that extension, and how can it be removed? [&#8230;] High Sierra has a new [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"","apple_news_api_id":"","apple_news_api_modified_at":"","apple_news_api_revision":"","apple_news_api_share_url":"","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[],"tags":[131,828,30,1529,1235],"class_list":["post-20010","post","type-post","status-publish","format-standard","hentry","tag-bug","tag-kernel-extensions","tag-mac","tag-macos-10-13","tag-system-integrity-protection"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=20010"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20010\/revisions"}],"predecessor-version":[{"id":20036,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20010\/revisions\/20036"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=20010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=20010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=20010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}