Unsigned (Legacy) Extensions in El Capitan?

Running an iMac 21.5-inch (Mid-2011) with 2.5GHz Intel Core i5, 4GB DDR3 1333MHz, 500GB Internal HD, (2) 3TB Thunderbolt External Drives, (1) 1.5TB FireWire800 External Drive, M-Audio FireWire 410 at the end of the FireWire800 Bus and now not loading drivers.


Extensions (from System Report) states the following:


M-AudioFireWireBeBoB:


Version: 1.10.2

Last Modified: 7/28/11, 2:27 PM

Bundle ID: com.m-audio.driver.firewire

Loaded: No

Obtained from: Not Signed

Kind: Universal

Architectures: i386, ppc, x86_64

64-Bit (Intel): Yes

Location: /System/Library/Extensions/M-AudioFireWireBeBoB.kext

Kext Version: 1.10.2

Loadable: No

Signature Validation Errors: Not Signed

Dependencies: Satisfied

Signed by: Not Signed



Until I installed El Capitan, the M-Audio FireWire 410 worked perfectly. I don't remember having to use the bypass (sudo nvram boot-args="kext-dev-mode=1) for unsigned extensions in Yosemite. I just read the bypass may be completely disabled in El Capitan. Is there an alternative?


I realize this is "legacy" equipment, but most of my digital music equipment is, as it is too expensive to replace. The manufacturer isn't going to spend time on signed drivers for this older equipment. Before I start considering a replacement, which will take a lot of research to factor in the manufacturer's record for providing signed drivers for Mac OS X, is there any way to get El Capitan to permit this one extension to load?

iMac, OS X El Capitan (10.11), 21.5-inch (Mid-2011) 4GB RAM

Posted on Oct 3, 2015 7:12 AM

Reply
22 replies

Oct 13, 2015 5:39 AM in response to Yidoman

Unfortunately, no, other than very scary kernel hacks I am not comfortable trying to implement. I've been too busy to address this appropriately since I discovered the issue, but will do so shortly. I intend to write a letter to Tim Cook and call him out on Apple's constant profession that they support music, especially unknown or emerging artists yet disable that creativity with policies that unnecessarily obsolete equipment that is designed to last much longer than the average computer. I think a fairly easy solution is allowing users to create a plist somewhere that lists extensions they would like to load despite them being unsigned. That takes Apple off the hook if there is a security breach, which is why they're claiming signing extensions is necessary. I'll repost here when I get the letter written.

Oct 15, 2015 4:37 AM in response to roncarfl

You very likely need to wait for a signed driver update from M-Audio, but should not need to replace your hardware. M-Audio has a KB article they are maintaining that lists devices currently compatible with El Capitan, and those that are not yet supported. Perhaps read through this to get more info on your specific device: http://m-audio.com/kb/article/1919

Oct 13, 2015 6:17 AM in response to roncarfl

roncarfl wrote:


which will take a lot of research to factor in the manufacturer's record for providing signed drivers for Mac OS X,

I used to have some M-Audio kit, but it took them six months to release new drivers for Snow Leopard. They've been slow with every new OS.

Since then, I've moved gradually to audio kit that works with no drivers. For instance, the Edirol FA-66 is a FireWire audio interface that is CoreAudio compatible, without any drivers.

Oct 13, 2015 6:54 AM in response to roncarfl

roncarfl wrote:

I think a fairly easy solution is allowing users to create a plist somewhere that lists extensions they would like to load despite them being unsigned. That takes Apple off the hook if there is a security breach, which is why they're claiming signing extensions is necessary.

Doing that would totally defeat the purpose of the new security features in El Capitan -- if users can create a plist file like that, so can malware. If you really need to use the old driver, you can disable System Integrity Protection (SIP) -- there are several web sites that explain how to do that you can find easily with a search on that phrase. However, all of them will tell you it isn't a good idea to do so unless you absolutely need to.


Something else to consider is that the old driver may not be fully compatible with El Capitan even if SIP is disabled, & could cause unstable operation & possibly data loss if you try to use it.

Oct 15, 2015 5:22 AM in response to roncarfl

You could try reinstalling a freshly downloaded copy of the 2011 Firewire 410 driver. That might work, but only if the software is signed with an ID that El Capitan accepts as valid.


To find out if the already installed version is, you can launch System Information (which you can do quickly by holding down the option key & choosing that app from the Apple menu) & then choosing "Extensions" in the software section of the System Information window. Give it a minute to gather the info & then look for an entry for the driver. To make it easier to find, you can click on the "Obtained from" column to sort the list by that criterion. Anything showing "Not Signed" or "Unknown" in that column will not load even if it is installed, but anything showing "Identified Developer" should.


It should not be necessary to reinstall a properly signed driver but for whatever reason I had to do that for the driver for my Kensington trackball.

Oct 15, 2015 5:45 AM in response to R C-R

To late to Edit my previous reply, but I just noticed that in your first post you included info from System Information for the driver currently installed on your Mac. According to that, you have version 1.10.2 installed, but the Snow Leopard & Lion one I mentioned a few posts back is a later one (version 1.10.3).


The 1.10.2 version definitely will not load under El Capitan -- note the "Loadable: No" line in your system report -- but the newer one might.

Oct 15, 2015 6:57 AM in response to R C-R

I actually found a version 1.10.5, but it won't install; I get the message below. I also tried uninstalling; that failed as well. I disabled System Integrity Protection (http://www.howtogeek.com/230424/how-to-disable-system-integrity-protection-on-a- mac-and-why-you-shouldnt/) and tried again; same results, but, of course, the driver loaded. The System Preferences app for the device hangs, but otherwise, it works fine, e.g., as MIDI note input and mic input in Logic Pro X. I don't know the risks running with SIP disabled, but it's a workaround for now.


In your opinion, do you think it's a better practice to keep SIP enabled until I need to do a recording session, then disable it, re-enabling when I've finished recording? Or just leave it disabled? I've been using OS X since Jaguar and was acquainted enough with Unix to work with various Open Source software installations and configurations as I was a software developer for 30 years. I am very careful with what I install.

User uploaded file

Oct 15, 2015 11:14 AM in response to roncarfl

In your opinion, do you think it's a better practice to keep SIP enabled until I need to do a recording session, then disable it, re-enabling when I've finished recording?

Personally, I would not disable SIP to begin with, even for something like that. The fact that the driver you found (where?) hangs the device's system preference suggests there is something about it that is not fully compatible with El Capitan, so if for no other reason than to protect your system files from potential damage I would keep SIP enabled. (SIP doesn't care if it is malware, intentional user changes, or whatever that would try to alter protected files or memory -- not even root can do that with SIP enabled.)


What I would do is remove the 1.10.5 software by whatever means necessary & try installing the 1.10.3 version -- if it will install, you can try the System Information thing I mentioned earlier to see if it is signed. If not, you should be able to trash & then delete it manually from wherever System Info indicates it is located, even if it is in a protected folder, as long as you authenticate as an admin user. (At least I have been able to do that for items marked as "Unknown" or "Unsigned" that don't load at startup time.)

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Unsigned (Legacy) Extensions in El Capitan?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.