What post-install kexts are and why you might need them

A kext (kernel extension) is a piece of software that runs at the deepest level of macOS, controlling hardware like your graphics card, network adapter, or trackpad. Most kexts come built into macOS or install automatically when you add new hardware. A post-install kext is one you install yourself after macOS is already running — usually because you've added hardware that macOS doesn't recognize on its own, or because you're using a Hackintosh (a non-Apple computer running macOS).

Installing kexts through Terminal means typing commands instead of clicking an installer. This method gives you direct control and works when graphical installers fail or don't exist. It also lets you see exactly what's happening, which matters when something goes wrong.

Key Takeaways

  • Kexts live in specific folders on your Mac — usually /Library/Extensions or /System/Library/Extensions — and you move them there using Terminal commands.
  • Modern Macs with Apple Silicon chips (M1, M2, M3) have stricter security that may prevent unsigned kexts from loading, even if you install them correctly.
  • Before installing any kext, disable System Integrity Protection (SIP) in Recovery Mode, or the Mac will block the kext from running.
  • After moving a kext into place, you must rebuild the kernel cache using sudo kextcache or the kext won't load when you restart.
  • If a kext breaks your Mac, you can boot into Safe Mode or Recovery Mode to remove it without needing the kext to load first.

Checking whether your Mac can run unsigned kexts

Before you spend time installing a kext, you need to know whether your Mac will actually load it. Apple's security system, System Integrity Protection (SIP), blocks unsigned kexts — ones that don't have Apple's digital signature — from running. On Intel Macs, you can disable SIP and load unsigned kexts. On Apple Silicon Macs (M1 and newer), even with SIP off, you cannot load unsigned kexts at all.

To find out which chip your Mac has, click the Apple menu, choose About This Mac, and look at the line that says "Chip". If it says "Apple M1", "M2", "M3", or similar, you have Apple Silicon. If it says "Intel Core", you have an Intel Mac. If your kext is unsigned and you have Apple Silicon, the installation will complete but the kext won't load — you'll need a signed version instead.

You can check whether a specific kext is signed by opening Terminal and typing codesign -v /path/to/kext. If the kext is signed, Terminal will print "valid on disk". If it's unsigned, you'll see an error.

Disabling System Integrity Protection in Recovery Mode

To install an unsigned kext on an Intel Mac, you must turn off System Integrity Protection first. This is a one-time step that requires restarting into Recovery Mode. Restart your Mac and hold down Command + R when ready after you hear the startup sound. Keep holding until you see the Apple logo or a spinning globe.

Once in Recovery Mode, click Utilities in the menu bar, then Terminal. Type csrutil disable and press Enter. Terminal will print a message saying SIP is off. Restart your Mac normally by clicking the Apple menu and choosing Restart. Your Mac will boot back into regular macOS with SIP disabled.

After you've installed your kext and confirmed it works, you should turn SIP back on for security. Repeat the steps above, but type csrutil enable instead. If a kext stops working after you re-enable SIP, that's a sign the kext is unsigned and your Mac is blocking it.

Moving the kext file to the correct folder

Kexts are actually folders with a .kext extension. They contain the actual driver code plus configuration files. You need to move the kext folder into one of two places: /Library/Extensions (for third-party kexts) or /System/Library/Extensions (for system-level kexts). Most of the time, /Library/Extensions is the right choice.

Open Terminal and use the sudo cp command to copy the kext. If your kext is on your Desktop and called MyDriver.kext, type:

sudo cp -r ~/Desktop/MyDriver.kext /Library/Extensions/

Terminal will ask for your password. Type it (you won't see the characters appear) and press Enter. The -r flag tells Terminal to copy the entire folder and everything inside it. The sudo prefix gives you administrator permission, which you need to write to /Library/Extensions.

If you're moving the kext from a different location, replace ~/Desktop/MyDriver.kext with the actual path. You can drag the kext file into Terminal to paste its full path instead of typing it.

Rebuilding the kernel cache so the kext loads

After you move a kext into place, macOS doesn't automatically know it's there. You have to rebuild the kernel cache — a file that tells macOS which kexts to load at startup. Without this step, your kext will sit in the folder but never actually run.

In Terminal, type:

sudo kextcache -i /

This command scans your Mac's kext folders and rebuilds the cache. It may take a minute or two. When it's done, Terminal will return to the prompt. On newer Macs, you might see a message about "prelinked kernel" — that's normal.

Some Macs also require you to touch the Extensions folder to mark it as changed. Type:

sudo touch /Library/Extensions

After both commands complete, restart your Mac. When it boots back up, the kext should load automatically.

Verifying the kext loaded and troubleshooting if it didn't

To check whether your kext is actually running, open Terminal and type:

kextstat | grep MyDriver

Replace MyDriver with the name of your kext. If the kext loaded, you'll see a line with its name and a number on the left. If you see nothing, the kext didn't load.

If the kext didn't load, check the system log for error messages. Type:

log show --predicate 'process == "kernel"' --last 10m | grep -i MyDriver

This shows kernel messages from the last 10 minutes that mention your kext. Common errors include "signature invalid" (the kext is unsigned and SIP is on), "dependency not found" (the kext needs another kext that isn't installed), or "architecture mismatch" (the kext was built for a different Mac chip than yours).

If the kext breaks something and your Mac won't start normally, restart and hold Command + S to boot into Safe Mode. In Safe Mode, kexts don't load, so you can use Terminal to remove the broken kext. Type sudo rm -r /Library/Extensions/MyDriver.kext and restart normally.

Removing a kext you no longer need

To uninstall a kext, open Terminal and type:

sudo rm -r /Library/Extensions/MyDriver.kext

Replace MyDriver.kext with the actual kext name. The -r flag removes the entire folder. After deletion, rebuild the kernel cache again:

sudo kextcache -i /

Then restart your Mac. The kext will no longer load.

Frequently Asked Questions

What's the difference between /Library/Extensions and /System/Library/Extensions?

/Library/Extensions is for third-party drivers you install yourself. /System/Library/Extensions is for Apple's own drivers and should not be modified unless you know exactly what you're doing. Always use /Library/Extensions unless the kext documentation specifically says otherwise.

Can I install a kext without disabling SIP?

You can copy the kext file into the folder, but it won't load. macOS will block it at startup. If you have an Apple Silicon Mac, disabling SIP won't help — you need a signed kext instead. For Intel Macs, you must disable SIP to run unsigned kexts.

My kext installed but nothing changed. How do I know if it's working?

Use kextstat | grep to confirm the kext loaded. If it's loaded but your hardware still isn't working, the kext may not be compatible with your Mac's configuration, or it may need additional setup. Check the kext's documentation or support forum for next steps.

What happens if I restart before rebuilding the kernel cache?

The kext won't load. You'll need to boot back into macOS, rebuild the cache, and restart again. Rebuilding the cache is a required step — skipping it means the kext is installed but inactive.

Can I install multiple kexts at once?

Yes. Copy each kext into /Library/Extensions, then run sudo kextcache -i / once at the end. You only need to rebuild the cache one time after all kexts are in place.