Editing Loadable kernel module (section)

=== macOS ===
In [[OS X Yosemite]] and later releases, a kernel extension has to be [[Code signing|code-signed]] with a developer certificate that holds a particular "entitlement." Such a developer certificate is only provided by Apple on request and not automatically given to [[Apple Developer]] members. This feature, called "kext signing", is enabled by default and it instructs the kernel to stop booting if unsigned kernel extensions are present.<ref>{{Cite web|url=https://developer.apple.com/library/content/documentation/Security/Conceptual/System_Integrity_Protection_Guide/KernelExtensions/KernelExtensions.html|title=Kernel Extensions|date=September 16, 2015|website=Mac Developer Library|publisher=Apple|archive-url=https://web.archive.org/web/20160817085001/https://developer.apple.com/library/mac/documentation/Security/Conceptual/System_Integrity_Protection_Guide/KernelExtensions/KernelExtensions.html|archive-date=August 17, 2016|url-status=live|access-date=September 29, 2016}}</ref> In [[OS X El Capitan|{{Nowrap|OS X}} El Capitan]] and later releases, it is part of [[System Integrity Protection]].

In older versions of macOS, or if kext signing is disabled, a loadable kernel module in a kernel extension bundle can be loaded by non-root users if the OSBundleAllowUserLoad property is set to True in the bundle's property list.<ref>{{cite web|title=Info.plist Properties for Kernel Extensions|url=https://developer.apple.com/library/mac/#documentation/Darwin/Conceptual/KEXTConcept/Articles/infoplist_keys.html|publisher=[[Apple Inc.]]|access-date=September 27, 2012|url-status=live|archive-url=https://web.archive.org/web/20120926232217/http://developer.apple.com/library/mac/#documentation/Darwin/Conceptual/KEXTConcept/Articles/infoplist_keys.html|archive-date=September 26, 2012}}</ref> However, if any of the files in the bundle, including the executable code file, are not owned by root and group wheel, or are writable by the group or "other", the attempt to load the kernel loadable module will fail.<ref>{{man|8|kextload|Darwin}}</ref>