Kernel Extensions

[Adrian]

Can someone tell me why the following kext's come up as "Integrity: Unknown" in the System profiler?

/System/Library/Extensions/hypervisor.kext
/System/Library/Extensions/vmmain.kext

There are a bunch of us trying to work out an issue with the corruption of OS X Window Shadows (see the following Apple Discussions link for more info) to see if these have anything to do with it. Note that this issue seems to only be appearing on the Mac Mini.

Regards,

Adrian.

 

[bbraun]

I've been looking at the IOKitUser source for kext validation and have come to the conclusion that System Profiler uses a different kext validation system than iokituser. IOKitUser defines several possible integrity values: Unknown, Correct, the kext has been modified, there is no reciept, and the kext is not Apple's (http://darwinsource.opendarwin.org/10.4.6.x86/IOKitUser-297/kext.subproj/KXKext.h). Since we can't actually see how System Profiler is doing its verification, the message is so vague as to be useless, and system profiler doesn't even list all the kexts (Pvsnic and Pvsnet are missing from my display, apparently because I don't have permission to read the Info.plist file within them, and is also missing an HP scanner driver I have installed), I suggest the display from System Profiler is worse than useless.

I would guess that ideally, system profiler compares the checksum of the kext as recorded in the reciept file (/Library/Reciepts/Parallels*/Contents/Archive.bom) against what it is on disk. However, Unknown would imply a problem with System Profiler, not with the kext, to me. Given that "modified" and "no reciept" are valid values for a kext's integrity, reporting "unknown" is rather useless.