Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

macstatic

macrumors 68020
Original poster
Oct 21, 2005
2,052
175
Norway
I've had this problem several times in the past, discussed it in other thread and even found a solution to this myself, but apparently this doesn't always work (I had to install a new KEXT recently) but now I believe I have a final solution to the problem.

The problem: when adding a new KEXT (Kernel Extension) you're asked if it should be allowed on your Mac. This comes up in the "Security & Privacy" system preference (select its "General" tab section) where you'll see an "Allow" button after you've installed the new KEXT from whatever installer has done that.
The problem is that this button sometimes doesn't work at all! You can press it all you want but it doesn't go away.
1_allowbutton.png


The cause: apparently this happens because 3rd party software might have been installed which captures mouse-clicks (here's another page which explains the problem in relation to Sophos software).
I assume this "feature" has been added so other people can't hack into your system and install malware or whatever outside your control. My problem is that I don't know of any such software on my Mac, and I don't know what to remove or disable in order to get this to work!


The solution: simple!
You just start (or restart) the computer into "safe mode", click the "Allow" button, then restart into normal mode again.
You might need to disable SIP (System Integrity Protection) first, though I believe I didn't have to, but I may be wrong.

Here's a step-by-step guide on what you need to do whenever you encounter an "Allow" button in the "Security & Privacy" system preference that won't respond when you click it:
  1. Start (or restart) the computer, then immediately press (and keep holding) SHIFT while the Mac starts up. This starts the Mac into "Safe mode". You can let go of the SHIFT-key when you see the startup progress-bar.
  2. Go to the Apple menu, select "System Preferences", then click on "Security & Privacy"
    Screen Shot 2022-12-08 at 10.55.25.png
    Screen Shot 2022-12-08 at 10.55.49.png
  3. Be sure to select the "General" tab, then click on the "Allow" button.
    This time it should work (it'll disappear when you press it).
    1_allowbutton_general.png
  4. A message will pop up, telling you to restart in order to enable the new software.
    You can press the "OK" button and restart later, but you only have 30 minutes to approve it, so I recommend you press the "Restart" button which restarts the Mac right away.
    2_rebootafterallow.png
  5. The computer will now restart, but this time don't do anything special (don't press any keys) and let it start up normally.
    When done, go back into the "Security & Privacy" system preference to check if the "Allow" button has gone away as it should.
    If it hasn't, try first to disable SIP, restart (into "safe mode"), then try clicking the "allow" button again. Remember to enable SIP afterwards (to keep your Mac more secure).
 
Last edited:
Alternatives:
- load without user consent (spctl kext-consent disable)
- consent for individual kext (spctl kext-consent add)
- profile with a list of allowed kexts (MDM)

Documentation:
Apple - User-Approved Kernel Extension Loading
https://support.apple.com/guide/security/kernel-extensions-sec8e454101b/web
Apple - Enterprise management of legacy system extensions
https://support.apple.com/en-us/HT211860
The Eclectic Light Company - How to bypass Mojave 10.14.5’s new kext security
https://eclecticlight.co/2019/06/01/how-to-bypass-mojave-10-14-5s-new-kext-security/
MIT- Approving Kernel Extensions for macOS – Troubleshooting
https://kb.mit.edu/confluence/display/istcontrib/Approving+Kernel+Extensions+for+macOS
Pike's Universum - User Approved Kernel Extension Loading…
https://pikeralpha.wordpress.com/2017/08/29/user-approved-kernel-extension-loading/
ProfileCreator https://github.com/ProfileCreator/ProfileCreator
 
  • Like
Reactions: startergo
Thanks. Lots of info there, but dare I say quite complex and mostly not for beginners/normal users.
Personally I've struggled with these issues for a while, and I'm glad the above steps have helped solved it for me. Fortunately I won't have to deal with these issues again.
 
but dare I say quite complex and mostly not for beginners/normal users
It’s not that complicated:
- get TEAMID of the kext from System Information – Software – Extension. For Intel is Z3L495V9L4, mentioned in the line "Signed by"
- Reboot in Recovery, open Terminal and allow kext to be loaded:
Code:
spctl kext-consent add Z3L495V9L4
It should work with SIP enabled.
 
Maybe not. I'll have to spend some time with this to better understand it.
On a sidenote I've been having a lot of spinning beachballs on a Macbook Pro and ran Etrecheck Pro to get some help and it mentioned among other things that several Kernel Extension files are blocked (probably because I didn't find a solution to Security & Privacy system preference's "Allow" button to work)
Screen Shot 2022-12-14 at 11.21.17.png

... and now the 30 minutes I have for this is of course gone:
Screen Shot 2022-12-14 at 11.22.34.png

Instead of having to go through re-installing all of the software this has happened to, is there a way (in the Terminal perhaps) that I can get the "Allow" button to reappear again, so I can once again try to approve them?
 
I’m not aware of any way to re-display the allow message on High Sierra.
On later macOS versions, running kmutil trigger-panic-medic from Terminal in Recovery resets the allow status and the user has to re-allow each kext.
For Techtool Pro, try from Terminal in Recovery
Code:
spctl kext-consent add PF6S3C5776
I got the TeamID PF6S3C5776 from TechTool Pro 16.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.