Page 2 of 2

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Fri Mar 16, 2018 1:20 pm
by Bitmann
Not sure if this will help anyone but here goes. I had this identical issue, except mine is a Mid-2012 MacBook Air. Last thing I had done was install Little Snitch V4.0.4. Upon reboot, it hung.

Verbose mode also hung at random points. It wasn't consistent. Safe mode didn't seem to work for me. So I restarted in single user mode and ran fsck - it said my disk seemed okay. When I exited single user mode, I immediately entered recovery mode by holding Command+R after the startup chime. Once there, I chose Disk Utility, selected my drive (which is formatted APFS; not case-sensitive or encrypted) and chose First-Aid. It also said my disk seemed okay. As a last resort, after exiting Disk Utility I chose "Startup disk..." from the Apple menu, selected my disk (the only option) and restarted. Voila! Rebooted just fine and has been working great ever since.

It seems that blessing the disk did the trick, but I included all the steps I took, just in case it was something else. Good luck with solving this issue on your MBP.

Just FYI - if you use APFS case-sensitive, OneDrive will not work. Hence why I'm using APFS case-insensitive. Also, there seems to be no way to transition from one to the other without a complete wipe and re-install.
My Crypto Project

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Mon Mar 19, 2018 1:26 pm
by christian
I had this issue after installing LS on a brand new iMac. Not even the developers of LS seem to be immune to this type of issue...

It took me several hours to find out what's going on. Here's the solution (and explanation) in short: When Little Snitch's kernel extension is installed, a new kernel must be built. This happens automatically and is performed by the "kextcache" utility. LS Installer waits until kextcache finishes ("Updating boot caches") before it offers a reboot. If kextcache is interrupted for whatever reason, the kernel may not be up-to-date and no new rebuild is attempted. (In most cases it will be consistent even if interrupted, though.)

In my case the graphics driver was missing and Window Server could not load. This also affected Safe-Boot mode. It was possible to log in remotely via ssh and analyze the issue, though.

In order to fix it, re-trigger "kextcache". This can be done by deleting "LittleSnitch.kext" from /Library/Extensions/ and reinstalling LS afterwards, or a simple

sudo touch /Library/Extensions

in a Terminal should suffice, too. When you do this, make sure to wait long enough to let kextcache finish.

Things are further complicated by the fact that the system does not boot properly. If you are lucky and can login via ssh, you can perform these steps directly. Otherwise you need to boot into rescue mode (hold down Cmd and R keys during boot), open Disk Utility to mount the hard drive with File > Mount (required at least if you use full disk encryption) and then open a Terminal window and change directory to /Volumes/you-hard-drive-name (where you have to replace your-hard-drive-name with the actual name, of course):

cd /Volumes/your-hard-drive-name

From there you can trigger the rebuild with a relative path:

touch Library/Extensions

and watch kextcache:

ps axww | grep kextcache | grep -v grep

When it's finished, reboot.

And, finally, for all those who want to know why kextcache was interrupted in the first place: I was fiddling around because the system did not allow LS kernel extension to be loaded. The Security Preferences Pane included an allow button for LS.kext, but clicking the allow button had no effect. It turned out that Apple ignores the button when the panel is operated via ScreenSharing...

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Sun Apr 01, 2018 2:49 am
by gilby
I had this issue after installing v4.0.6. christian, thanks for the clear instructions on how to fix it!

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Thu Apr 05, 2018 3:13 pm
by ronakjain90
Hello Team

I've tried all the suggested solutions, however the issue doesn't fix up for me.

1. rm -rf Library/Extensions/LittleSnitch.kext
2. sudo touch /Library/Extensions

I've also tried to boot in safe mode and tried to uninstall the said application. However nothing happens post that and my Mac just fails to boot back up.

Kindly assist.

I feel that the software developers should warn the users of this huge underlying problem, if they already know that something like this exist. I'm disappointed.

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Sat Apr 07, 2018 9:43 pm
by ehpehp
I updated to 4.0.6 with High Sierra on a MPB 2016 13" w TB. I had the same issue with Mac stalling at restart. After ~1 hour of searching for a solution and running disk utility, I was able to start in safe mode (hold shift key down after restart). I removed Library/Extensions/LittleSnitch.kext using Pathfinder app. I've uninstalled Little Snitch for now.

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Mon Apr 09, 2018 12:58 pm
by christian
@ronakjain90: The "rm -rf Library/Extensions/LittleSnitch.kext" did not do anything because you did not prefix it with "sudo". Only root can delete entries in "/Library/Extensions" and the "-f" option suppresses error messages. And note that you really need to wait until the boot caches have been rebuilt. This can take a long time!

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Mon Apr 09, 2018 1:00 pm
by christian
And one more thing: If you booted in recovery mode, the path is not "/Library/Extensions", but rather "/Volumes/name-of-your-harddisk/Library/Extensions". Replace "name-of-your-harddisk" with the appropriate value, of course. If there are spaces in the name, you need to quote the name with single or double quotes.

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Sat Sep 01, 2018 6:33 am
by roberto
christian wrote:And, finally, for all those who want to know why kextcache was interrupted in the first place: I was fiddling around because the system did not allow LS kernel extension to be loaded. The Security Preferences Pane included an allow button for LS.kext, but clicking the allow button had no effect. It turned out that Apple ignores the button when the panel is operated via ScreenSharing...


I think you're onto something here. My scenario was a little different.

While installing LS 4.1.3 I was prompted to allow LS in the security preferences. The System Preferences window was automatically opened and I accepted, but I believe the prompt alone is causing the kernel extension interruption and broke my install.

In order to fix mine, I followed others' suggestions and:

- booted into recovery mode (cmd+r)
- launched Disk Utility
- mounted my Macintosh HD
- quit Disk Utility
- launched terminal
- mv /Volumes/Macintosh HD/Library/Extensions/LittleSnitch.kext /Volumes/Macintosh HD/tmp
- touch /Volumes/Macintosh HD/Library/Extensions (I don't think this does anything)
- reboot

Once rebooted, LS complained that the installation went bad. At this point I ran the LS installer again, and upon reboot, the machine and LS worked fine.

HTH

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Mon Jan 07, 2019 10:43 am
by dwolfboulder
SOLVED: MacBook Will Not Start Up After macOS Update

I have a MacBook pro running MacOS Mojave.
For the past year or so, every time a new MacOS update rolls out, and is attempted to be installed on my MacBook, it ends up displaying the circle slash (Prohibitory Symbol). Rebooting still produces a prohibitory symbol. I’m still able to boot into recovery mode (CTRL-R at Startup), however running disk repair on my MacBook HD does NOT solve the problem. I have also tried: (a) specifying the startup disk (problem still persists); (b) attempting to start in safe mode (problem persists); doing the NVRAM reset (problem persists). In the past, the only way i was able to get around the problem, is by re-formatting my HD, installing latest version of Mojave OS, and then migrating all my data from my TimeMachine backup.

This happened again the other day with the recent Mojave update 10.14.2.
My computer automatically installed the update overnight, and in the morning, my screen was showing circle slash. This time i did some more research, and discovered that the issue may be caused by UNSIGNED KERNEL EXTENSION (KEXT) files existing on my HD.

Kernel Extension is a piece of code that extends the capability of the base kernel of an operating system. The kernel typically manages I/O requests, and in OS X, the file ends in “.kext.”

Starting with Yosemite, kernel extensions must be code signed by the developer with Apple authorization or OS X won’t load them. Sometimes these un-signed kernel extensions cause this headache after an OS X or macOS update.

USING TERMINAL COMMANDS IN RECOVERY MODE, YOU SHOULD BE ABLE TO RESOLVE THIS PROBLEM BY REMOVING UNSIGNED KEXT EXTENSIONS FROM LOCATION: /Volumes/<your system's drive name>/Library/Extensions/

After I removed the following KEXT files from the /Volumes/<your system's drive name>/Library/Extensions/ directory, my MacBook booted up properly, and finished installing the Mojave update.

UNSIGNED KEXT EXTENSIONS REMOVED FROM Directory:
<your system's drive name>/Library/Extensions/
(note: this is DIFFERENT directory from /System/Library/Extensions/)

BJUSBLoad.kext (Creator: Canon)
CIJUSBLoad.kext (Creator: Canon)
ParagonSnapshot.kext (Creator: Paragon)
ufsd_NTFS.kext (Creator: Paragon)
VDMounter.kext (Creator: Paragon)
LittleSnitch.kext (Creator: LittleSnitch)

Note: When I removed these KEXT Extensions, the “circle slash” problem did not resolve until i finally removed: ParagonSnapshot.kext and VDMounter.kext

FURTHER DETAILS:
Below is a link to a useful article which provides some helpful information regarding:
MacBook Will Not Start Up After macOS Update, How-To Fix
https://appletoolbox.com/2016/10/macboo ... pdate-fix/
In that article, the section titled “Un-Assigned Kernel Misfiring” explains how to boot into recovery mode and launch Terminal utility. However, one problem with that article is that the kextstat command is not available in Terminal utility running in recovery mode.

As a work-around, these are the steps i took to solve the problem:
1. Boot to Recovery (with CMD + R or CMD + Shift + R if you don't have recovery partition)
2. First, pick Disk Utility, select your main disk and Mount it; this is required if your disk is encrypted and requires password to be mounted
3. Now select Disk Utility -> Quit; then Utilities -> Terminal
4. Begin typing in Terminal following commands:
4a. cd /Volumes/
4b. cd <your system's drive name>
(Note: If your system drive has any spaces in it’s name, then put the name in single quotes. For example, my MacBook boot drive is called “MacBook HD”, so the command I would type is: cd ‘MacBook HD’
4c. cd library
4d. cd extensions
4e. ls
(Note: first letter is a lower case L)
After you type ‘ls’, you should see a list of KEXT extensions like this:
ACS6x.kext CIJUSBLoad.kext
ATTOCelerityFC8.kext CalDigitHDProDrv.kext
ATTOExpressSASHBA2.kext HighPointIOP.kext
ATTOExpressSASRAID2.kext HighPointRR.kext
ArcMSR.kext PromiseSTEX.kext
BJUSBLoad.kext SoftRAID.kext

The KEXT extensions listed above are all ones properly signed by Apple.
These KEXT extensions can remain, but if you have other KEXT extensions listed, chances are that some or all of those others are causing the issue.

If you see any of these extensions (listed below), you should be able to safely delete them in order to fix your problem. I’d recommend removing each extension, one at a time, then rebooting to see if it worked, and if not, repeat steps above and delete next one. Based on my limited research, the ones i’d recommend deleting first are:
ParagonSnapshot.kext (Creator: Paragon)
VDMounter.kext (Creator: Paragon)
LittleSnitch.kext (Creator: LittleSnitch)
ufsd_NTFS.kext (Creator: Paragon)

While in Terminal utility (in Recovery mode), to delete (or remove) a desired KEXT extension (eg., LittleSnitch.kext) type:
rm -r <full name of extension>
(eg, “rm -r LittleSnitch.kext”)

9. quit the terminal and restart

Hope this helps! :)
Good luck!!

Re: Mac doesn't start after installing Little Snitch 4.0.5

Posted: Mon Jan 07, 2019 11:33 am
by christian
Just a note: LittleSnitch.kext is code signed with an appropriate certificate. Since you say the "problem did not resolve until i finally removed: ParagonSnapshot.kext and VDMounter.kext", I assume that one of these was not properly signed.