It's definitely the Benjamin Fleischer Extension that won't install and that extension is not maintained by Boxcryptor. I tried installing Fleischer's last MacFuse (4.0.4) and it failed in the same exact manner. Since Cryptormator can optionally be used without the Fleischer extension, maybe Boxcryptor can offer the same.

    Apple shifting security model away from extensions will mean a huge change to architecture...not likely a quick fix.

      matgra Perhaps but they’re still allowed and I’ve installed other updated extensions like Airfoil audio without a problem. The problem here is the Fleischer extension is borked. Also, if the Cryptomator app can work without the extension, I’m guessing Boxcryptor could as well although Boxcrytor Portable is pretty much unusable.

          Robert

          I have been able to get Boxcryptor working on an M1 MacMini, but only by following the instructions above and turning of System Integrity Protection. If SIP remains on, even with the reduced security policy, Boxcryptor won't work.
          There's some irony that an add-on intended to provide additional security requires reducing OS security to make it work. Do you know yet if this is a temporary fix?

              Here's a partial workaround that's more amusing than useful. Sideload the iOS version of Boxcryptor (google up iMazing M1 sideload for the process) and the Boxcryptor iOS version runs very smoothly on the M1 except the process to upload a file silently fails. When you download, you have to open it by sharing it to something like the Notes app. Also, I'm guessing Apple will soon put out an update to prevent sideloading iOS apps 😄

                Ok, this is getting really into "issue mode" for me...

                I cannot en/decrypt on my Mac anymore;
                and the workaround with the iOS app is no workaround - I can open files, I can create folders, but I cannot fully decrypt the files (only open on the fly);

                Also using apple's own files app, I tried to move UNencrypted folder into a newly created (in Boxcryptor iOS app) folder to encrypt them - files app gives an error saying communications with the help app impossible...

                So I am stuck with not being able to grab and run with my own old files, and not being able to add new ones.

                  Hello everybody,

                  Thank you for your feedback. In macOS 11.0 Big Sur, Apple introduced a new security feature called "Signed System Volume" (SSV):

                  SSV features a kernel mechanism that verifies the integrity of the system content at runtime, and rejects any data — code and non-code — that doesn’t have a valid cryptographic signature from Apple." (Source).

                  SSV is a pretty serious internal change especially when interacting with the macOS kernel and therefore, Apple completely rewrote the kernel extension management in Big Sur - especially for Apple Silicon Macs. And as with many new things, they are not always flawless, i.e. the new kernel extension management was quite buggy during all Big Sur betas and it looks like the problems were not completely resolved in the final release. I would like to remind that Apple wanted to rewrite iCloud in macOS Catalina but reverted back to the "old" iCloud implementation after 6 or 7 Catalina betas because the "new" iCloud implementation was simply too faulty.

                  Yes, Apple has deprecated kernel extensions since quite some time now - but has not yet provided replacement APIs for all use cases which have used kernel extensions in the past. E.g. in macOS Catalina, Apple introduced replacement APIs for kernel extensions which were typically used in anti-virus software or network filtering applications and those apps are not allowed to use kernel extensions in Big Sur anymore. However, not all kernel extensions are equal and until today, Apple has not provided a replacement API for virtual disks like Boxcryptor, Google Drive File Stream, Box Drive, TrueCrypt, and many other apps are using. This functionality can still only be implemented using a kernel extension - even in Big Sur where such kernel extensions are still allowed. We know that Apple intends to move away from kernel extensions completely and expect that they will offer a replacement API for virtual disks in the future - but for now, we have to use a kernel extension to integrate nicely into the file system for the best user experience. I can ensure however, that we are closely watching Apple's development and will adapt Boxcryptor as required.

                  Boxcryptor is actually running very solid and natively on Apple Silicon Macs - if the kernel extension gets properly loaded by macOS. Installing (or updating) and loading the kernel extension is currently the biggest pain point on Apple Silicon and maybe also the one we can influence the least. Loading the kernel extension is actually not that complicated from an app perspective: We make one API call to request that macOS loads our kernel extension - and everything else is then in the hands of macOS' kernel extension management which, unfortunately, seems not be very solid yet.

                  Especially updating the kernel extension often fails for yet unknown reasons and macOS gets stuck in an endless "Kernel extension updated -> Approve -> Restart" loop as mentioned by users in this thread. Although the user approved the updated kernel extension, macOS fails to install the updated version and just keeps the old version installed. Directly installing the same kernel extensions without updating succeeds in most cases without problems - although we as an app perform the exact same macOS API call in both cases. This suggests that it may be caused by a bug in macOS which only Apple can resolve. We are in close contact with Benjamin, the maintainer of OSXFUSE / macFUSE (which we're using in a special version) in order to find a solution for this issue.

                  If you experience problems to install or update the kernel extension, you can try if resetting the kernel extension management resolves it:

                  1. Boot to macOS Recovery by pressing & holding the power button for startup
                  2. If you have FileVault enabled, you might have to unlock and mount your system volume, see https://derflounder.wordpress.com/2019/01/18/unlock-your-filevault-encrypted-boot-drive-using-disk-utility-on-macos-mojave/
                  3. Run Terminal
                  4. Enter the command: kmutil trigger-panic-medic --volume-root /Volumes/Macintosh\ HD
                    (If your boot volume has a different name than "Macintosh HD", replace it in the command)
                  5. Restart your Mac
                  6. Start Boxcryptor and re-approve the kernel extension by "Benjamin Fleischer" in the Security Preferences
                  7. Restart your Mac (again)

                  If you are interested, outputs of the following commands can be useful to gather more information about the problem.

                  Print the current state of installed 3rd party kernel extensions:

                  kmutil inspect -B /Library/KernelCollections/AuxiliaryKernelExtensions.kc

                  Verbosevily load the BCFS kernel extension:

                  sudo kextutil -v 6 "/Applications/Boxcryptor.app/Contents/Frameworks/BoxcryptorFoundation.framework/Versions/A/Filesystems/bcfs.fs/Contents/Resources/mount_bcfs.app/Contents/Extensions/11/bcfs.kext/"

                  Best regards,
                  Robert

                  PS: If you experience the Approve -> Reboot loop, which macOS Big Sur version are you running? The stable 11.0.1 or the 11.1 Beta 2?

                    Version V2.39.1101 does not work on 11.1 Beta (20C5061b) -> Not able to enable the system extension

                      NBruns
                      I also tried 11.1 RC, but had no luck. Removing the kernel extension also did not work.

                          NBruns Thank you for your feedback. The kernel extension loading is very likely caused by a confusion of the macOS kernel management which version to load. Boxcryptor comes with different versions of the kernel extension for the different macOS versions (e.g. 10.14, 10.15, 11.0) and macOS sometimes seems to try to load the wrong version for an older macOS version which obviously fails on Big Sur.

                          Can you try to manually delete the non-Big Sur kernel extension versions and see if this improves the situation? To delete them, please execute the following command in the Terminal app:

                          sudo rm -rf /Applications/Boxcryptor.app/Contents/Frameworks/BoxcryptorFoundation.framework/Versions/A/Filesystems/bcfs.fs/Contents/Resources/mount_bcfs.app/Contents/Extensions/10*

                              Hi everybody,

                              We're pretty confident that the kernel extension loading problem is caused by the kernel extension manager being confused which version of the kernel extension to load and trying to load one for a different, wrong macOS version. While we're continuing our efforts to provide a single app for all supported macOS versions, here's an experimental version which contains only the kernel extension for macOS 11 Big Sur:

                              https://www.dropbox.com/s/capkjj2zf1txcmq/Boxcryptor_v2.39.1110_Installer.dmg?dl=0

                              If you experience any problem loading the kernel extension (and thus mounting the Boxcryptor disk) with Apple Silicon Macs, please use this version and I'd be happy to hear your feedback.

                              Note: If you already upgraded to Big Sur 11.1, you might have to reset the kernel extension management so that any wrong kernel extension is properly removed from the system after you updated Boxcryptor:

                              1. Uninstall Boxcryptor (Move it to the Trash and empty it)
                              2. Boot to macOS Recovery by pressing & holding the power button for startup
                              3. Open Utilities -> Terminal
                              4. Enter the command:
                                kmutil trigger-panic-medic --volume-root /Volumes/Macintosh\ HD
                                (If your boot volume has a different name than "Macintosh HD", replace it in the command)
                              5. Verify that the command output includes the following content:
                                All third party kexts have been unapproved and uninstalled from /Volumes/Macintosh HD
                              6. Restart your Mac
                              7. Verify that macOS shows the "Panic Medic Boot" alert as shown below
                              8. Install the latest Boxcryptor version and run it
                              9. Allow the Boxcryptor system extension in System Preferences -> Security & Privacy
                              10. Restart your Mac

                              Best regards,
                              Robert

                              You will get feedback ASAP, on Friday I will be back in home office.

                                • SSAL

                                  • Post #29

                                  Did get Boxcryptor to work with Big Sur 11.0.1 with M1, but after update to 11.1, and trying your advice from yesterday, the restart problem occurred again.

                                  I'm also experiencing the same issue as SAL with the most recent update. Let me know if there are any logs or information I can send along to help.

                                      flakingbiscuit SAL

                                      Thank you for the feedback. I'd have two questions:

                                      a) Is it correct that you upgraded from macOS 11.0.1 with Boxcryptor pre-2.39.1110 (e.g. 2.39.1101) to macOS 11.1 with Boxcryptor 2.39.1110 ?
                                      b) Did you try the kmutil trigger-panic-medic command in Recovery Mode?

                                      Additionally, the following steps would be very helpful:
                                      1) Open Console app and start streaming (Start button in the toolbar)
                                      2) Open Terminal app and execute the following commands:

                                      sudo kextutil -v 6 /Applications/Boxcryptor.app/Contents/Frameworks/BoxcryptorFoundation.framework/Versions/A/Filesystems/bcfs.fs/Contents/Resources/mount_bcfs.app/Contents/Extensions/11/bcfs.kext
kmutil diagnose

                                      3) Stop Console streaming, search for kernelmanagerd and export the output (Select all -> Copy -> Paste in TextEdit)
                                      4) Send the Console and Terminal outputs to support@boxcryptor.com

                                      Thank you for your help,
                                      Robert

                                            FYI: Based on current feedback (maybe not so much here, but in direct contact in our support), the latest experimental version 2.39.1110 seems to work great on macOS 11.1.

                                            The only source for problems is when a user updated macOS from 11.0.1 to 11.1 and did not already have 2.39.1110 installed. In this case, macOS fails to unload the old kernel extension. Resetting the kernel extension management using kmutil trigger-panic-medic as described above resolves this issue.

                                              Robert I'm one of those folks who upgraded to 11.1 (yesterday) without the latest version of Boxcryptor., which I've now installed.

                                              I've tried the kmutil trigger-panic-medic fix, but no success. I also tried the manual delete extension terminal command above, but that didn't work. Just an error saying the sudo command wasn't recognised or something similar.

                                                part of the problem appears to be that the approvals of the kext aren't persisting from boot to boot. I got it working and then on the next reboot (no other changes/updates) it went back to the problem. Even after the kmutil attempt a couple of times. Will attempt to further diagnose.

                                                  Nevermind. This one was total user error. I updated to BC 2.39.1101 somehow vs .1110. Update app to .1110, kmutil flush and then auth and reboot seems to work.