View Other Properties

Contents

View Other Properties

How to List Kernel Extensions Across All Macs

Using Kolide, You Can Easily View and Query Mac Kernel Extensions Across Your Fleet.

Introduction

The kernel is the core of a device's operating system which lives in memory and has complete control over everything in the OS. The kernel facilitates communication between a device's software and hardware. On most systems, the kernel is the first program loaded on startup (after the BIOS).

What Mac Kernel Extension Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to performantly collect Mac Kernel Extensions from Macs in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide metliciously documents every piece of data returned so you can understand the results.

Mac Kernel Extensions Schema

Column Type Description
id Primary Key

Unique identifier for the object

device_id Foreign Key

Device associated with the entry

device_name Text

Display name of the device associated with the entry

idx Text

Kernel extension load tag or index

linked_against Text

Indexes of extensions this Kernel extension is linked against

name Text

Kernel Extension label

path Text

Optional path to extension bundle

signature_authority Text

Certificate Common Name for signature

signature_cdhash Text

Hash of the Kernel Extension contents

signature_identifier Text

The signing identifier sealed into the signature

signature_team_identifier Text

The team signing identifier sealed into the signature

signed Boolean

true if the Kernel extension is signed, otherwise false

version Text

The text representation of the version

version_major Bigint

version's semver major version (ex: 4.2.1 would yield 4)

version_minor Bigint

version's semver minor version (ex: 4.2.1 would yield 2)

version_patch Bigint

version's semver patch version (ex: 4.2.1 would yield 1)

version_subpatch Bigint

version's numeric status fourth position number (ex: 4.2.1.6 would yield 6)

version_pre Text

version's semver pre-release version (ex: 1.2.3-prerelease+build would yield pre-release)

version_build Text

version's semver build version (ex: 1.2.3-prerelease+build would yield build)

collected_at Timestamp

Time the row of data was first collected in the database

updated_at Timestamp

Time the row of data was last changed in the database

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

Find unsupported hackintosh Macs running Apple virtualization kernel extensions
Kolide SQL
SELECT 
   device_name, 
   signed AS kext_signed, 
   name AS kext_name,
   version AS kext_version
FROM mac_kernel_extensions	
WHERE name ILIKE '%fakesmc%'	
   OR name ILIKE '%virtualsmc%'	
   OR name ILIKE '%rehabman%';	
Example Results
device_name kext_name kext_signed kext_version
Chris-Hackintosh org.netkas.driver.FakeSMC 0 1800
macOS-debug-build com.rehabman.driver.USBInjectAll 0 0.6.3
Jerrys-iMax org.netkas.driver.FakeSMC 0 1800
it-sec org.netkas.driver.FakeSMC 0 1800
it-sec com.rehabman.driver.USBInjectAll 0 0.6.3

Why Should I Collect Mac Kernel Extensions?

Collecting information about the Kernel is largely a diagnostic task which can assist in troubleshooting scenarios, for example when a device is experiencing stability issues which affect a particular version of the OS's kernel.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

Unless you are running a custom kernel which you have created (you would know if this was the case) it is unlikely that the data contains any sensitive information.

No additional personally identifiable data is collected or transmitted as part of this inventory.

When you use Kolide to list Mac Kernel Extension data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed by employees through Slack or Google Workspace account.

Share this story:

Related Device Properties:

New
Mac System Extensions
operating-system, kernel, extensions, stability
New
Windows Update Settings
updates, operating-system, security
New
Windows Pending Updates
updates, operating-system, security
View full list of Kolide's Device Properties
Try Kolide Free
Try Kolide Free