Thank you for your feedback. In macOS 11.0 Big Sur, Apple introduced a new security feature called "Signed System Volume" (SSV):
SSV features a kernel mechanism that verifies the integrity of the system content at runtime, and rejects any data — code and non-code — that doesn’t have a valid cryptographic signature from Apple." (Source).
SSV is a pretty serious internal change especially when interacting with the macOS kernel and therefore, Apple completely rewrote the kernel extension management in Big Sur - especially for Apple Silicon Macs. And as with many new things, they are not always flawless, i.e. the new kernel extension management was quite buggy during all Big Sur betas and it looks like the problems were not completely resolved in the final release. I would like to remind that Apple wanted to rewrite iCloud in macOS Catalina but reverted back to the "old" iCloud implementation after 6 or 7 Catalina betas because the "new" iCloud implementation was simply too faulty.
Yes, Apple has deprecated kernel extensions since quite some time now - but has not yet provided replacement APIs for all use cases which have used kernel extensions in the past. E.g. in macOS Catalina, Apple introduced replacement APIs for kernel extensions which were typically used in anti-virus software or network filtering applications and those apps are not allowed to use kernel extensions in Big Sur anymore. However, not all kernel extensions are equal and until today, Apple has not provided a replacement API for virtual disks like Boxcryptor, Google Drive File Stream, Box Drive, TrueCrypt, and many other apps are using. This functionality can still only be implemented using a kernel extension - even in Big Sur where such kernel extensions are still allowed. We know that Apple intends to move away from kernel extensions completely and expect that they will offer a replacement API for virtual disks in the future - but for now, we have to use a kernel extension to integrate nicely into the file system for the best user experience. I can ensure however, that we are closely watching Apple's development and will adapt Boxcryptor as required.
Boxcryptor is actually running very solid and natively on Apple Silicon Macs - if the kernel extension gets properly loaded by macOS. Installing (or updating) and loading the kernel extension is currently the biggest pain point on Apple Silicon and maybe also the one we can influence the least. Loading the kernel extension is actually not that complicated from an app perspective: We make one API call to request that macOS loads our kernel extension - and everything else is then in the hands of macOS' kernel extension management which, unfortunately, seems not be very solid yet.
Especially updating the kernel extension often fails for yet unknown reasons and macOS gets stuck in an endless "Kernel extension updated -> Approve -> Restart" loop as mentioned by users in this thread. Although the user approved the updated kernel extension, macOS fails to install the updated version and just keeps the old version installed. Directly installing the same kernel extensions without updating succeeds in most cases without problems - although we as an app perform the exact same macOS API call in both cases. This suggests that it may be caused by a bug in macOS which only Apple can resolve. We are in close contact with Benjamin, the maintainer of OSXFUSE / macFUSE (which we're using in a special version) in order to find a solution for this issue.
If you experience problems to install or update the kernel extension, you can try if resetting the kernel extension management resolves it:
- Boot to macOS Recovery by pressing & holding the power button for startup
- If you have FileVault enabled, you might have to unlock and mount your system volume, see https://derflounder.wordpress.com/2019/01/18/unlock-your-filevault-encrypted-boot-drive-using-disk-utility-on-macos-mojave/
- Run Terminal
- Enter the command:
kmutil trigger-panic-medic --volume-root /Volumes/Macintosh\ HD
(If your boot volume has a different name than "Macintosh HD", replace it in the command)
- Restart your Mac
- Start Boxcryptor and re-approve the kernel extension by "Benjamin Fleischer" in the Security Preferences
- Restart your Mac (again)
If you are interested, outputs of the following commands can be useful to gather more information about the problem.
Print the current state of installed 3rd party kernel extensions:
kmutil inspect -B /Library/KernelCollections/AuxiliaryKernelExtensions.kc
Verbosevily load the BCFS kernel extension:
sudo kextutil -v 6 "/Applications/Boxcryptor.app/Contents/Frameworks/BoxcryptorFoundation.framework/Versions/A/Filesystems/bcfs.fs/Contents/Resources/mount_bcfs.app/Contents/Extensions/11/bcfs.kext/"
PS: If you experience the Approve -> Reboot loop, which macOS Big Sur version are you running? The stable 11.0.1 or the 11.1 Beta 2?