If you updated to macOS Catalina 10.15 you may have seen a warning message about kernel extensions. That’s because Apple is deprecating some of them in macOS 11 Big Sur.
The message refers to “legacy system extensions” and says they “aren’t as secure or reliable as modern alternatives.” Apple is replacing some of them with an Endpoint Security Framework. In a support page Apple mentions the change:
In 2019, Apple informed developers that macOS Catalina will be the last macOS to fully support legacy system extensions, and we’ve been working with developers to transition their software. By moving beyond these extensions, developers are helping to further modernize the Mac, improve its security and reliability, and enable more user-friendly software distribution methods. A final transition date has not yet been set.
The following kernel extensions will be deprecated, and Apple’s support page tells developers which frameworks to use instead.
- KAUTH: Use EndpointSecurity
- Network Filter: Use Network Extension
- IOHIDFamily: Use HIDDriverKit instead
- IOUSBFamily: Use IOUSBHostFamily or USBDriverKit
- USB Networking: use USBDriverKit (for USB KPIs) or NetworkingDriverKit (for IONetworkingFamily KPIs)
- USB Serial: Use USBDriverKit (for USB KPIs); SerialDriverKit Or USBSerialDriverKit (for IOSerialFamily KPIs)
- USB Vendor Specific IPC: Use USBDriverKit or IOUSBHost (for USB KPIs) or DriverKit for communication channels
The move is meant to increase user security because the kernel is a sensitive part of the operating system that controls everything else. Keeping third-party apps out of this area is a good thing.
Note: This article was originally published on March 26, 2020. It has been updated with new information.