System Software Consent UI does not appear if Security & Privacy Preference Pane was already open

Originator:phil
Number:rdar://FB7690358 Date Originated:May 6, 2020 at 4:18 PM
Status: Resolved:
Product:macOS Product Version:10.15.4
Classification: Reproducible:
 
Which preference pane are you seeing issues with?
Security & Privacy
Description
Please describe the issue and what steps we can take to reproduce it:
When an application is attempting to install a DriverKit System Extension (dext), the “System Extension Blocked” popup appears. Upon clicking “Open Security Preferences,” one would expect to be taken to the UI for authorising the system extension. If the System Preferences app was already open on the “Security & Privacy” pane, this user interface does not appear until navigating to the overview and re-entering the pane. It is neither clear from the UI that this is required, nor is it clear why it should be required even once you know what to do.

See attached screen recording.

To reproduce:

1. Launch an application which installs a dext. (A demo app is attached in both binary and source forms; the binary is signed with a development certificate, so kext/dext signature checks in SIP must be disabled, and the amfi_get_out_of_my_way=0x1 boot-arg must be set.)
2. Ensure the System Preferences.app is launched and that the Security & Privacy pane is open.
3. Perform whatever steps necessary in the app to trigger a dext activation request. (In the DemoDriver app, hit “Install Dext”)
4. Receive the “System Extension Blocked” popup.
5. Click “Open Security Preferences”
6. Focus shifts to the System Preferences app

Expected: Ability to approve the extension

Actual: Approval UI is missing until user navigates away from security pane and re-enters it.

This affects the current release macOS 10.15.4 (19E387) and current beta 10.15.5 (19F72f) versions, and likely all earlier macOS 10.15.x releases.
File Uploads
System_Profile_full.spx
sysdiagnose_2020.05.06_15-58-26+0200_Mac-OS-X_Macmini6-2_19F72f.tar.gz
no-dext-consent-when-pane-open.mov
DemoDriver.zip
DemoDriver-source.zip

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!