> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# System extensions on macOS with Iru Endpoint
> Learn about macOS system extensions and how to manage them with Iru Endpoint. Understand network extensions, endpoint security, and driver extensions.
This Library Item is available for Mac computers
### What Is a System Extension?
System extensions are the modern replacement for kernel extensions (kexts) in macOS Catalina and later. With system extensions, Apple provides new frameworks for developers to perform tasks previously reserved for kexts. The primary benefit of system extensions is that they run in user space rather than kernel space, which means they can't compromise the built-in security or stability of macOS. Although kexts still work in macOS Catalina, Apple has deprecated certain types, and developers should migrate their kexts to system extensions as equivalent frameworks become available.
Currently, there are three new system extension frameworks available to replace kexts:
* **DriverKit**: Create drivers for USB, Serial, NIC, and HID devices that users can install in macOS Catalina or newer. [Learn more about DriverKit.](https://developer.apple.com/documentation/driverkit)
* **Network Extensions**: Distribute network extension apps such as content filters, DNS proxies, and VPN clients as system extensions in macOS Catalina or newer. [Learn more about NetworkExtension.](https://developer.apple.com/documentation/networkextension)
* **Endpoint Security**: Monitor and block system events using the EndpointSecurity API to conform with security policies and protect from malicious activity in macOS Catalina or newer. [Learn more about Endpoint Security](https://developer.apple.com/documentation/endpointsecurity)
Kexts that operate outside of these new frameworks—such as virtualization software—must continue to use kexts until Apple offers equivalent system extension frameworks.
System extensions can also be allowed using a separate configuration profile.
If you're using an application that still uses a kernel extension, we recommend reaching out to your software vendors to encourage them to migrate to system extensions.
#### Additional Information
[Kernel Extensions Overview](https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/KernelProgramming/Extend/Extend.html#//apple_ref/doc/uid/TP30000905-CH220) - Apple Developer Documentation Archive
[System Extensions](https://developer.apple.com/system-extensions/) - Apple Developer
### What Is a Kernel Extension?
Kernel extensions, sometimes referred to as kexts, allow developers to load code dynamically into the macOS kernel. They provide access to internal kernel interfaces that enable complex apps to function properly. Examples include virtualization applications and hypervisors such as Parallels or VMware Fusion.
### The Difference Between Kernel Extensions and System Extensions
If you're unsure whether a piece of software uses a system extension or a kext, there are a few ways to find out:
* Contact the software manufacturer
* After installing your software, run the command below to list all active system extensions. If no system extensions are listed, the software likely uses a legacy kext
```bash systemextensionsctl-list.sh theme={null}
systemextensionsctl list
```
Here's an example of the output you might see if no system extensions are installed:
```bash terminal-output.txt lines theme={null}
Iru Endpoint Support@TestMac1 ~ % systemextensionsctl list
0 extension(s)
```
Here's an example of the output you might see if a system extension is installed:
```bash systemextensionsctl-with-extensions.txt lines theme={null}
Iru Endpoint Support@TestMac1 ~ % systemextensionsctl list
1 extension(s)
--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
* * 9PTGMPNXZ2 com.symantec.mes.systemextension
(10.0.0/10.0.0) Symantec
[activated enabled]
```
### Create a System Extension Profile
Follow these steps to create a system extension profile in Iru Endpoint that will pre-approve an application's system extension(s).
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.
Give your new profile a descriptive name, such as *System Extension Allowance*.
Select the designed [Blueprints](/en/endpoint/blueprints/assignment-maps).
Optional: If you deselect **Allow users to approve system extensions**, this will prevent all users on the Mac—including local administrators—from approving additional system extensions not approved via a profile. Selecting this option will also disapprove any system extensions a user has previously approved.
Input the **Team ID**; this is the identifier in the third column of the Terminal output generated by the *systemextensionsctl list* command discussed above.
Optionally provide a **Name** to associate with the Team ID.
Under the **System Extensions** portion, you may optionally change the default value of **Approve all system extensions**. Leaving this option at its default setting will preapprove any System Extension from the specified Team ID. You can optionally set this option to one of the following:
* **Allow specific system extensions**: Allows you to specify the exact bundle ID of the specific system extension you want to approve; use the bundle ID generated by the *systemextensionsctl list* command described above. You can also optionally configure one or more of these specific extensions to be able to be removed automatically by admin tooling, such as Iru Endpoint or a vendor-provided package.
* **Allow specific system extension types**: Allows you to specify system extension types from a developer—such as endpoint security extensions, driver extensions, or network extensions—that you want to be preapproved. For our Symantec example, we would approve the **Endpoint security extensions** type, as this matches the extension type generated by the *systemextensionsctl list* command described above.
Optionally, you can select the **Add Team ID** button to allow additional system extensions in a single profile.
Click **Save**.