osxfuse fails to load on Yosemite due to unsigned kext

[nicolas.stransky@…]

Hi, After upgrading to Yosemite / Xcode 6.1, osxfuse 2.7.0 fails to load. I get this error message when using sshfs:

/opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext failed to load - (libkern/kext) not loadable (reason unspecified); check the system/kernel logs for errors or try kextutil(8).
the OSXFUSE file system is not available (71)

I do not see anything in the system/kernel logs, as suggested, but might not be looking at the right place. Thanks for any ideas on how I can resolve this! I can provide more information if needed.

[fondacio@…]

This might be relevant: ​https://github.com/Homebrew/homebrew/issues/31164. Relevant quote:

"This is going to be a big pain in the behind for Homebrew, MacPorts, and compiling things from source generally.

Currently, from 10.10, the system no longer permits unsigned kexts to run, at all. The only public way to circumvent this 'security' measure at the moment is to disable all kext signing checks, which is a less than delightful solution.

The other way is limited to those with Apple development signing capabilities, which involves signing the kexts with your own certificates which will then enable them to run under Yosemite."

[fondacio]

Cc Me!

[chris@…]

Cc Me!

[macports.org@…]

I do have an Apple developer certificate, but I ran into problems where my signature was valid, but not accepted by the system security assessment policy. The problem seems to be that not every developer certificate can be used to sign kernel extensions. This may prove to be a real problem for many (most) MacPorts users.

Meanwhile, I have used the following workaround:

1. Install the upstream (i.e. "official") osxfuse binary from ​https://osxfuse.github.io/ that corresponds to what MacPorts is using. At the time of this writing, it is 2.7.0.
2. In the shell, replace the MacPorts osxfuse with the signed binary:

   $ cd /opt/local/Library/Filesystems
   $ sudo mv osxfusefs.fs osxfusefs.fs.macports
   $ sudo ln -s /Library/Filesystems/osxfusefs.fs osxfusefs.fs
   

Any port that has a dependency on /opt/local/Library/Filesystems/osxfusefs.fs/... should now work.

I have tested successfully with encfs and TrueCrypt (the latter with a local portfile, see ​https://trac.macports.org/ticket/41421 for details).

Maybe the cleanest solution is to modify the osxfuse port to download and install the upstream binaries?

[macports.org@…]

Cc Me!

[macports.org@…]

I just found this ​https://github.com/osxfuse/osxfuse/issues/169:

Yeah, Homebrew will actually soon be transitioning to refusing to build source packages that ship kexts for Yosemite for this reason, so at some point in the next few days you should start getting an automatic message to install the upstream binaries instead whenever you try to install a from-source kext on Yosemite.

Seems like the Homebrew maintainers want to require people to manually install kernel extensions. I'd prefer an automated install, if possible.

[yszhou4tech@…]

Cc Me!

[yszhou4tech@…]

Replying to macports.org@…:

I do have an Apple developer certificate, but I ran into problems where my signature was valid, but not accepted by the system security assessment policy. The problem seems to be that not every developer certificate can be used to sign kernel extensions. This may prove to be a real problem for many (most) MacPorts users.

Meanwhile, I have used the following workaround:

1. Install the upstream (i.e. "official") osxfuse binary from ​https://osxfuse.github.io/ that corresponds to what MacPorts is using. At the time of this writing, it is 2.7.0.
2. In the shell, replace the MacPorts osxfuse with the signed binary:

   $ cd /opt/local/Library/Filesystems
   $ sudo mv osxfusefs.fs osxfusefs.fs.macports
   $ sudo ln -s /Library/Filesystems/osxfusefs.fs osxfusefs.fs
   

Any port that has a dependency on /opt/local/Library/Filesystems/osxfusefs.fs/... should now work.

I have tested successfully with encfs and TrueCrypt (the latter with a local portfile, see ​https://trac.macports.org/ticket/41421 for details).

Thanks for the tip. I may note that the osxfuse version must match what sshfs requires. As of this writing, it is 2.7.0, not the newest stable 2.7.2. Otherwise, the following error may appear when trying to use sshfs.

this OSXFUSE library version is incompatible with the OSXFUSE kernel extension

Another glitch is that if sshfs or other filesystems that depend on osxfuse was installed later, the installation process may emit the following error, but the installation will still work without problem.

--->  Activating sshfs @2.5_0
--->  Cleaning sshfs
--->  Updating database of binaries
--->  Scanning binaries for linking errors
Warning: Error parsing file /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext.dSYM/Contents/Resources/DWARF/osxfusefs: Error opening or reading file
--->  No broken files found.

Maybe the cleanest solution is to modify the osxfuse port to download and install the upstream binaries?

I agree :)

[SickTeddyBear]

Cc Me!

[smaret (Sebastien Maret)]

Cc Me!

[cgarcia@…]

Cc Me!

[ramundsen85]

Cc Me!

[drkp (Dan Ports)]

See also discussion on macports-dev: ​https://lists.macosforge.org/pipermail/macports-dev/2014-October/028508.html

[anddam (Andrea D'Amore)]

Cc Me!

[Guymer (Thomas Guymer)]

Cc Me!

[mark.chilenski@…]

Cc Me!

[pope (K. Adam Christensen)]

Cc Me!

[nilstec_inc@…]

Cc Me!

[Russell-Jones-OxPhys (Russell Jones)]

Cc Me!

[sicherha@…]

Cc Me!

[jul_bsd@…]

Cc Me!

[macports@…]

Cc Me!

[ozaktash@…]

Cc Me!

[tammer42@…]

Cc Me!

[chadwickboggs (Chadwick Boggs)]

Cc Me!

[fhgwright (Fred Wright)]

Cc Me!

[drkp (Dan Ports)]

Should be fixed in r129493. We are now installing the signed kext from the osxfuse dmg on Yosemite.

[someuser12]

Replying to macports.org@…:

Meanwhile, I have used the following workaround:

1. Install the upstream (i.e. "official") osxfuse binary from ​https://osxfuse.github.io/ that corresponds to what MacPorts is using. At the time of this writing, it is 2.7.0.
2. In the shell, replace the MacPorts osxfuse with the signed binary:

   $ cd /opt/local/Library/Filesystems
   $ sudo mv osxfusefs.fs osxfusefs.fs.macports
   $ sudo ln -s /Library/Filesystems/osxfusefs.fs osxfusefs.fs
   

Any port that has a dependency on /opt/local/Library/Filesystems/osxfusefs.fs/... should now work.

Since an upgrade of osxfuse a couple of weeks ago, even under Mac OS 10.6.8 I got the same error message when trying to load osxfuse (/opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext failed to load - (libkern/kext) not loadable (reason unspecified); check the system/kernel logs for errors or try kextutil(8). the OSXFUSE file system is not available (71)). The workaround above solves the issue for me (with, at the time of this writing, the official 2.7.5 binary osxfuse and the port of osxfuse 2.7.5 installed). Thanks!

Therefore, I suggest extending the solution adopted in r129493 to Mac OS 10.6.

[someuser12]

Cc Me!

[fhgwright (Fred Wright)]

Replying to macosx12345@…:

Replying to macports.org@…:

Meanwhile, I have used the following workaround:

1. Install the upstream (i.e. "official") osxfuse binary from ​https://osxfuse.github.io/ that corresponds to what MacPorts is using. At the time of this writing, it is 2.7.0.
2. In the shell, replace the MacPorts osxfuse with the signed binary:

   $ cd /opt/local/Library/Filesystems
   $ sudo mv osxfusefs.fs osxfusefs.fs.macports
   $ sudo ln -s /Library/Filesystems/osxfusefs.fs osxfusefs.fs
   

Any port that has a dependency on /opt/local/Library/Filesystems/osxfusefs.fs/... should now work.

Since an upgrade of osxfuse a couple of weeks ago, even under Mac OS 10.6.8 I got the same error message when trying to load osxfuse (/opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext failed to load - (libkern/kext) not loadable (reason unspecified); check the system/kernel logs for errors or try kextutil(8). the OSXFUSE file system is not available (71)). The workaround above solves the issue for me (with, at the time of this writing, the official 2.7.5 binary osxfuse and the port of osxfuse 2.7.5 installed). Thanks!

Therefore, I suggest extending the solution adopted in r129493 to Mac OS 10.6.

It's certainly not exactly the same issue, since 10.6 has no kext signing requirement. Perhaps there's something wrong with your build system that causes kexts to build incorrectly. You don't mention using kextutil to see what OSX was complaining about.

[someuser12]

Replying to fw@…:

It's certainly not exactly the same issue, since 10.6 has no kext signing requirement. Perhaps there's something wrong with your build system that causes kexts to build incorrectly. You don't mention using kextutil to see what OSX was complaining about.

That's true, thanks. Actually, there is an architecture mismatch:

$ sudo kextutil /opt/local/Library/Filesystems/osxfusefs.fs/Support/osxfusefs.kext
Warnings: 
    Executable does not contain code for architecture: 
        i386

The kext was built only for x86_64 whereas the kernel is i386.

One way to fix this for me was to restore the use of @@KERNELARCHS@@ (both in the Portfile and in patch-buildsystem.diff) which was deleted in r131918 following #45794, so as to fix build on PPC. It seems that your concern in ​https://trac.macports.org/ticket/45794#comment:4 was justified: in my case (Intel MacBookPro running 10.6.8) the wrong architecture is chosen by the build system.