Removing Kernel extensions

[olfab]

Dear all,

The installation of "Parallels Desktop" includes the installation of kernel extensions. The uninstallation of Parallels Desktop is just moving the respecitve .app to the trash. Thus, the kernel extensions remain. Is my understanding correct?

I read https://developer.apple.com/library/archive/technotes/tn2459/_index.html, the manual page of kext util and https://www.maketecheasier.com/add-remove-kexts-from-macos/. According to these sources kernel extensions are located here:
/System/Library/Extensions/ -> The standard system repository of kernel extensions.
/Library/Extensions/ -> The standard repository of non Apple kernel extensions.
Are there more locations?

Has anyone experience with removing kernel extensions especially in identifying the right kernel extensions to be uninstalled?

Thanks and best regards,
Fabian

 

[Ritsuka]

Parallels kernel extensions are inside the Parallels .app bundle, so you only need to trash the app.

 

[olfab]

Thanks Ritsuka. Where did you find this information?

 

[Ritsuka]

It's the recommended way to use kernel extensions if they are only used when running the app. Vmware works the same way, and I use it, so I assumed Parallels works that way too. And the two folders you listed are the only ones.

 

[NoBoMac]

And the two folders you listed are the only ones.

In theory. An outlier, VirtualBox: they put a couple of extensions in /Library/Application Support/VirtualBox.

There is a command line program, kextstat, that will give one a list of loaded extensions. In case of Parallels, would do something like this:

kextstat -l | find -i parallel

If anything shows up, still have an extension loaded.

Variation of above, but gives you pathname to extension (guessing on Parallels bundle name here):

kextfind -case-insensitive -bundle-id -substring 'com.parallels.' -print

 

[olfab]

I understand. Thanks. The bottom line is: If an application installs new kernel extensions I have to manually allow this. Thus, I know when new kernel extensions have been installed. If new kernel extensions have been installed I have to check if they are installed outside the respective .app. If so they have to be removed manually.