Thanks for being a part of WWDC25!

How did we do? We’d love to know your thoughts on this year’s conference. Take the survey here

How to develop system extension if System Integrity Protection is enabled?

Hi

I am developing the packet tunnel extension on a SIP enabled device.

If I build the app and notarize and install it on the device, it works fine.

If I modify, build and execute the App (which contains the system extension), it fails with below error. 102.3.1.4 is production build. And 201.202.0.101 is for XCode build.

SystemExtension "<<complete name>>.pkttunnel" request for replacement from 102.3.1.4 to 201.202.0.101


Packet Tunnel SystemExtension "<<complete name>>.pkttunnel" activation request did fail: Error Domain=OSSystemExtensionErrorDomain Code=8 "(null)"

If SIP is disabled, it works fine.

Is there a way the system extension can be developed even if SIP remains enabled?

Answered by DTS Engineer in 836192022
Is there a way the system extension can be developed even if SIP remains enabled?

Yes.

The best way to do that depends on the type of sysex you’re creating. It sounds like you developing a Network Extension sysex, in which case see my advice in Debugging a Network Extension Provider.

IMPORTANT Don’t use Developer ID for day-to-day development. That’s a bad idea in general — see The Care and Feeding of Developer ID — and in this specific case it makes things harder.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Is there a way the system extension can be developed even if SIP remains enabled?

Yes.

The best way to do that depends on the type of sysex you’re creating. It sounds like you developing a Network Extension sysex, in which case see my advice in Debugging a Network Extension Provider.

IMPORTANT Don’t use Developer ID for day-to-day development. That’s a bad idea in general — see The Care and Feeding of Developer ID — and in this specific case it makes things harder.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

How to develop system extension if System Integrity Protection is enabled?
 
 
Q