What is kextload and kextunload on Mac?

here from Apple directly, I cannot remember I enabled it by downgrading Security etc. :

Important: Kexts

are no longer recommended for macOS. Kexts risk the integrity and

reliability of the operating system, and Apple recommends users select

solutions that don’t require extending the kernel.

Kernel extensions in a Mac with Apple silicon

Kexts

must be explicitly enabled for a Mac with Apple silicon by holding the

power button at startup to enter into One True Recovery (1TR) mode, then

downgrading to Reduced Security and checking the box to enable kernel

extensions. This action also requires entering an administrator password

to authorize the

Thank you for posting this Apple announcement. I also found a couple of articles that mention the same thing.

However, I scanned my SSD and found that I have more than 570 .kext files on my system. Obviously, some apps must rely on kextload and kextunload. I've gone ahead and disabled the kextload from the Login items. I'm assuming that at some point if an app requires kextload to load a kernel extension, I suppose I'll find out which app still relies on this legacy method...

philliprodo wrote:

I've gone ahead and disabled the kextload from the Login items. I'm assuming that at some point if an app requires kextload to load a kernel extension, I suppose I'll find out which app still relies on this legacy method...

There are multiple problems here.

First of all, this thread is several months old. It involved one specific question, which has been answered.

There is absolutely nothing wrong with kernel extensions. Yes, they sometimes cause kernel panics and unexpected restarts. But when that happens, you usually know it. Plus, it's easy to find the cause. And it really easy to fix.

Unironically enough, none of that is true for Apple's replacement for the kernel extension, the "System Extension".

More importantly, no one should ever use that new "Background Items" user interface to disable things like kextload commands (or to do anything, really). Granted, whatever app put a kextload in there is pretty crude to begin with. However, the correct action in this case is to uninstall the software completely. There is no way to tell what is going to happen with your computer with one key component of the app disabled.

etresoft wrote:

However, the correct action in this case is to uninstall the software completely.

That makes sense, if only one could tell which app installed kextload in the Login Items or which apps depend on using it. So far, I'm two days into having the kextload disabled and I haven't ran into any unexpected problems...

anil805 wrote:

I don't think I have any known issue. It just showed up as a login item upon starting MacBook. I wonder if it is some kind of malware, because I can't tell how it got in there.

You do not name it specifically(?)— so the guess work continues...

What I can say is— I have not seen malware makes it way to login items.

Many things end up in Login items you do not put there — in all honesty the new interface here is a bit of a mess and not well documented.

You can file a bug report /submit your Apple Feedback here:  http://www.apple.com/feedback 

anil805 wrote:

I don't think I have any known issue. It just showed up as a login item upon starting MacBook. I wonder if it is some kind of malware, because I can't tell how it got in there.

It's probably been there for years. It came with some software you installed.

But recently Apple decided to show some (but not all) of the information about these hidden files. It's been a real disaster.

Something that is loading or unloading a kernel extensions is definitely not malware. I can't guess about any of the other files.

I also have kextload in my start up items. It would be good to always know what starts up automatically but turning it off seems to make no troubles so far. I googled kextload and got to your question here... it sits in a folder called Macintosh HD/sbin (kextunload is also in the same folder but this one does not show up in my startup items)

I just got a new MacBook and noticed the same thing in startup items. Clicking on the 'i' information icon beside it, it showed a list of files that were loaded. From that list I could ascertain that it was a legacy NTFS utility (NTFS for Mac) that it was loading. I disabled it, because it's a utility I use only rarely for work and doesn't need to load at startup.

You didn’t disable the kextload tools at all. You just removed the one background item that used the deprecated methods. Any app can still use those tools until Apple removes them completely, which may be never.

Also, Apple will continue to use kernel extensions. They just don’t want third-party developers using them because they seem incapable of making ones that work correctly.

philliprodo wrote:

That makes sense, if only one could tell which app installed kextload in the Login Items or which apps depend on using it.

Oh, there's a way all right. Apple just doesn't tell you. I get tired of typing the same thing over and over again. What I didn't mention before is that, in addition to that new "Background Items" being something that people shouldn't use, it is also very poorly done. It typically leaves people more confused than they started with. The information is there, but Apple just doesn't tell you. And then Apple goes the extra mile by taking something that is already quite confusing and making it even more so. It's just really, rally bad.

There are alternatives. I can't mention it here in the forums because I wrote it.

The risk here isn't that you are going to suddenly start having problems. The risk is that, 6 months down the road, you are going to try some app you haven't run in 8 months. It either won't work, or it will corrupt its data, or you think it works and it is giving you incorrect results. And you don't know what app that is.

if all of a sudden you have a startup item that you cannot recognise and that you did not have before: I

You did have it before. You just didn't know it was there. I consider that a bigger issue not knowing what you install.

I was able to find my programme that put the kextload startup item in there. I found it through some software, maybe it was just the Activity Monitor from Apple - I cannot remember. In my case it was: NTFS for Mac from Paragon - software that has been translating/transcoding between NTFS (Microsoft files) and APFS (Apple files) without a flaw (I can really recommend it) for quite a while. It is from Paragon Software, an old, well known backup software company from Germany similar to Acronis etc.

why would they still use kernel extension/kextload? I have no idea but so far I would not want to miss my really good programme that can read and write on Microsoft (NTFS) formatted harddisks without noticable speed reduction.

But yes, you have to downgrade to "reduced security" on a Apple Silicon like somebody before explained and hope for an upgrade for your beloved programme that you do NOT want to uninstall:).

Maybe there is a good reason why special third party programmes still need the Kernel extension. I have not investigated that any further yet but I get warnings from Apple for another programme with Kernel extension that in the near future it might not work anymore - contact the software developer for further news/upgrades. Yes, it seems that they want to stop those Kernel extensions

I certainly know what I install, I just don't know what app installed the Kextload in the start-up items.

No app installed kextload into the start-up items.

Apple created kextload and some program you installed uses it for some reason.

Why do you suddenly not want that program to work as it was designed when you installed it?

Why do you suddenly not want that program to work as it was designed when you installed it?

When one sees a cryptically named program like kextload listed in the start-up items, one has to wonder how it got there and what purpose it serves--it could be malware for all we know. After reading this thread, I understand that it's not malware, but I'm still curious as to what program installed it. For all I know it could have been an app I installed a while ago, that I no longer use and have deleted it from my system.

The fact that it suddenly appeared is irrelevant. You gave some installer your admin password to install the background item that called the kextload utility. It was fine when you provided your admin password, but now it is not fine. I don't understand that at all. If you know what you installed, you should have known what it installed and why. I would never give an installer my admin password if I didn't know exactly what it was going to install.

"kextload" is not cryptically named. I understand how Unix operating systems work and know that kernel extensions are used to interface with hardware. The basic underpinnings of the OS is the "kernel" and "kernel extensions" extend the OS. The fact that a tool exists to load a kernel extension is not cryptic at all.