Can't allow extensions on Catalina

Discussion in 'Installation and Configuration of Parallels Desktop' started by PiersB1, Jan 31, 2020.

  1. PiersB1

    PiersB1 Bit poster

    Messages:
    2
    I've just bought a new iMac and am attempting to install Parallels on it.

    Installation proceeds fine until it gets to a point where we need to allow the systems extension. Unfortunately when I follow the instructions, the "Allow" button to give Parallels the permissions it needs doesn't appear.

    I looked, but couldn't find any other information about what permissions to grant in order to grant them manually.

    Parallels: Version 15.1.2 (47123)
    MacOS: 10.15.3 (19D76)
    Screenshot 2020-01-31 at 13.51.32.png Screenshot 2020-01-31 at 13.52.34.png
     
  2. PiersB1

    PiersB1 Bit poster

    Messages:
    2
    Report ID 331878930
     
  3. CraigW11

    CraigW11 Bit poster

    Messages:
    1
    I am having the same issue
     
  4. wime1

    wime1 Bit poster

    Messages:
    1
    Same issue. No allow button.
     
  5. Hi PiersB1. Please restart your Mac once and start Parallels Desktop. Then check whether you get the option to select the 'Allow' button in Mac system preference.
     
  6. mohammadr2

    mohammadr2 Bit poster

    Messages:
    1
    I have the same problem and restarting does not help resolve the issue. Is there a solution for this issue?
     
  7. Could you please share your Parallels Desktop version and update it to the latest (15.1.3) build if you didn't
     
  8. >>> Message has been deleted by the user <<<
     
    Maria@Parallels likes this.
  9. ZacharyH7

    ZacharyH7 Bit poster

    Messages:
    1
    The solution that worked for me is bypassing the kernel extension security that macOS has in place by whitelisting Parallels' Team ID so you won't get any message that says "Parallels needs to update their program" messages. Steps:
    • Start up your Mac in recovery mode (hold command + R) while powering on
    • Once you sign in, go to the top status bar and go to Utilities > Terminal
    • type in the following: /usr/sbin/spctl kext-consent add 4C6364ACXT
    In the status bar, restart the Mac and fire up Parallels. No kernel extension prompt.
     
    Maria@Parallels likes this.
  10. nikolais1

    nikolais1 Bit poster

    Messages:
    1
    MacBook Pro: macOS 11.5.2 (20G95)
    Parallells Desktop Version 16.5.1 (49187)


    Unfortunately I still get this error message reported in the start of this tread after adding
    -bash-3.2# /usr/sbin/spctl kext-consent add 4C6364ACXT
    Listing the added Team Identifications give me
    -bash-3.2# /usr/sbin/spctl kext-consent list
    Allowed Team identifiers:
    4C6364ACXT

    Checked the Team Identifier here:
    https://download.parallels.com/desk...siness-Edition-Administrators-Guide/44052.htm
     
  11. JohannesZ1

    JohannesZ1 Bit poster

    Messages:
    2
    Hi! I had the same problem after updating to Parallels Desktop 17 (on current MacOS BigSur 11.6) AND SOLVED IT FOR ME!

    Like in the original post, I was prompted to open the "Security & Privacy" Settings, but there was NO "Allow" button.

    Steps I tried which DID NOT seem to help:
    • Reboot the machine (a few times)
    • Reinstall Parallels Desktop 17
    • In recovery: spctl kext-consent add 4C6364ACXT (also confirmed with spctl kext-consent list)
    • sudo kextcache --clear-staging (this just temporarily cleans the /Library/StagedExtensions/Applications/ directory).
    • I manually tried to load the kext, which also should trigger the "Allow" button display in "Security & Privacy": kextload -b com.parallels.kext.hypervisor but this command just failed and also NO "Allow" button was displayed in "Security & Privacy" (like displayed in the original post):
    All of these steps seemed NOT to solve the problem!

    What I also realised is that (even after uninstalling Parallels Desktop 17) in the system database file /var/db/SystemPolicyConfiguration/KextPolicy there were these entries:

    Note:
    4C6364ACXT is the "team id" for parallels kernel extensions, see also here: https://download.parallels.com/desk...siness-Edition-Administrators-Guide/44051.htm
    sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy 'SELECT * FROM kext_policy WHERE team_id = "4C6364ACXT";'
    (This command only DISPLAYS the content, it doesn't change anything):

    For me, this command returned the following result:
    team_id|bundle_id|allowed|developer_name|flags
    4C6364ACXT|com.parallels.kext.hypervisor|1|Parallels, Inc.|28
    4C6364ACXT|com.parallels.kext.netbridge|1|Parallels, Inc.|28
    4C6364ACXT|com.parallels.kext.usbconnect|1|Parallels, Inc.|28
    4C6364ACXT|com.parallels.kext.vnic|1|Parallels, Inc.|28


    SOLUTION:
    Getting rid of the entries in the /var/db/SystemPolicyConfiguration/KextPolicy database will trigger macOS to ask the user again when the kext's are tried to be loaded the next time. This system database is protected and can only be changed in Recover mode. Steps to remove this 4 entries:
    • Shutdown your Mac
    • Power on and immediately press and hold <Cmd+r> (until the Apple logo is displayed, to boot into Recovery)
    • In Recovery, start the Disk Utility and "Mount" the "... Data" Disk (by right clicking on it in the tree on the left side). (If you have file vault enabled, this will ask for your password)
    • Then open the Terminal (from menu) and perform the following steps in terminal:
    • chroot /Volumes/<name_of_your_disk_volume> (use can use <Tab> for completion)
    • sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy
    • .headers on
    • SELECT * FROM kext_policy WHERE team_id = '4C6364ACXT'; (this should show you again the 4 entries as displayed above in pink)
    • DELETE FROM kext_policy WHERE team_id = '4C6364ACXT'; (this will delete the 4 entries)
    • .quit (quits the sqlite3 utility again)
    • Now close the Terminal app and reboot the Mac (using the menu)

    After reboot start again Parallels Desktop. It will (again) show you the prompt to open "Security & Privacy" System preferences, but this time, there IS a "Allow" button! :)
     

Share This Page