What is /Library/StagedExtensions for and how to remove extensions [closed]

Question

I'm trying to uninstall Parallels completely from macOS High Sierra. I removed everything from the disk except some Parallels extensions that are stored under /Library/StagedExtensions/Parallel Desktop.app

I think the location has to do with user approved extensions, but I'd like to find a way to remove/uninstall those too. If I try to delete the extensions it says operation not permitted despite the root rights.

Any idea?

Dozier

have you tried to check if the kernel extension is loaded or in kernel using command kextstat? run this kextstat command and check if you have any of the parallel extension. – Mumbletypeg

Answer 1

There is new way to clear the StageExtensions folder as following

sudo kextcache --clear-staging

This command will clear the /Library/StageExtensions folder. We dont need to go to recovery mode and delete manually this folder in case there are some permission errors while installing software.

Hubert

For me it did not remove the directory permanently. After the next reboot everything was back. – Selfemployed

Answer 2

In my case, deleted kext disappears from StagedExtensions when you invalidate kext cache.

sudo rm -rf /Library/Extensions/Parallel\ Desktop.app # check if the name is correct so you don't delete some other kext
sudo kextcache -invalidate /
# now you should not see your deleted kext here
ls /Library/StagedExtensions/

UPDATE 2019:

See man page for full details: man kextcache. Excerpt related to -invalidate, -i for short:

 -i os_volume, -invalidate os_volume
              Rebuild out-of-date caches and update any helper partitions
              associated with os_volume.

              This option mimics sudo touch /System/Library/Extensions on
              os_volume.  If kextcache cannot find or make sense of
              os_volume/usr/standalone/bootcaches.plist, the volume is treated
              as if no caches need updating: success is returned.

There are also new options:

     -clear-staging
          Clears the kernel extension staging area by removing all staged content.

     -prune-staging
          Prunes the kernel extension staging area by removing all kernel extensions
          no longer present in their original location.

Looks like -prune-staging removes only the deleted extensions, shaving little bit of time from the next kext cache rebuild.

See https://www.unix.com/man-page/mojave/8/KEXTCACHE/ for Mojave man page, which contains these new options.

Food

This only answers half the question, it doesn't explain what this folder is for – Rippy

Well... Only Apple knows why is it called like that, but it's, by the looks of it, used for kexts which are "staged", e.g. are cached, verified and ready for next boot. Kexts are copied there after successful boot - e.g. they are verified and approved/staged for next boot. At least that's what I take from it. – Food

Answer 3

sudo kextcache --clear-staging

Was in folder HD/Library/

Cheers

Edit: Formatting

Edit2: I believe that Parallels writes some files directly into the bootloader/kernel. After running the command from the CMD+R hold restart Disk Utility Terminal the extension was removed from /Library .

I hope this makes sense.

Wireworm

Please give an explanation on how and why your solution works for the question. – Jowett

Answer 4

I had a similar issue in trying to uninstall the TelestreamAudio.kext for ScreenFlow. What might be happening is that the kext in StagedExtensions is currently in use or protected while you're in regular mode. Once you get into Recovery mode, you can delete it without disabling System Integrity Protection. The following steps worked for me, though please use caution.

• Click the  menu. Select Restart
• Hold down command-R to boot into the Recovery System
• Choose Disk Utility from the Recovery Menu
• Within Disk Utility click on your main hard drive (e.g. Macintosh HD) and then click on Mount
• Exit out of Disk Utility
• Click Utilities in the menu bar and select Terminal
• Use the following commands:

.

cd /Volumes/Macintosh\ HD/Library/StagedExtensions/Library/Extensions/
rm -rf NAME_OF_EXTENSION.kext

• Close the Terminal app
• Click the  menu and select Restart

From there on, I was able to reinstall ScreenFlow's audio kext and it worked. It may also help you completely remove the Parallels kext.

Beersheba

Answer 5

If you've already deleted the extensions from /Library/Extensions, open the Terminal app from Launchpad, copy/paste the command below and press Enter to run it:

sudo kextcache -prune-staging

As mentioned in another comment, this will only remove the kernel extensions that are no longer present in their original location, i.e., /Library/Extensions.

The extensions you deleted from /Library/Extensions will then disappear from /Library/StagedExtensions/. It won't affect your other kernel staged extensions.

/Library/StagedExtensions/ is an intermediate area where your extensions live after you start your session (like a cache). The staging area won't be immediately affected if changes are made to /Library/Extensions, which I believe is meant to improve stability and security.

Samuelson

Answer 6

This is because of the System Integrity Protection (SIP). You can disable it (not recommended) and remove the kext manually.

(from https://www.imore.com/el-capitan-system-integrity-protection-helps-keep-malware-away)

• Click the  menu. Select Restart...
• Hold down command-R to boot into the Recovery System.
• Click the Utilities menu and select Terminal.
• Type csrutil disable and press return.
• Close the Terminal app. Click the  menu and select Restart....

If you decide later you want to re-engage SIP (and I earnestly hope that you do), repeat these steps, use csrutil enable instead.

Amplify

No, above is not the solution to a problem. Customer wont disable SIP and remove it. I guess this is serious bug from apple – Hubert

I have already reported this to apple but i haven't got any response from them. If they reply, ill let you know guys – Hubert