Hello Team, We have a System Extension with Provider Type "DNS Proxy". We have embedded the System Extension in GUI target which registered as LaunchAgent. We found NEDNSProxyManager saves the proxy configuration in the caller's preferences. Due to that we see a prompt for Network Extension when switching users. On allowing that we see multiple DNS filter in the System Settings->Network->Filters even though one DNS Filter can enabled which is annoying. Question 1: Is this expected for non MDM users? Are the users expected to authorise Network extension when switching users. Question 2: Is there a way to prevent the multiple DNS filter for both MDM and non MDM users? To prevent multiple filters, we identified a solution to embed the System Extension in our LaunchDaemon target. So the proxy configuration will be save in the root preference. But with this approach we ended up with an error [OSSystemExtensionErrorDomain error 13] during OSSystemExtensionRequest.deactivationRequest. Question 3: Is there a way to avoid OSSystemExtensionErrorDomain 13 when deactivating System extension from our LaunchDaemon process? Question 4: What is the best practice in terms of embedding and deploying DNS Proxy System Extension for managed and non managed environment. Also if user expected to see multiple DNS filter. I suggest to show the filter that saved for that user's preference. Thank you.

Hello Team, I want to know if there's a way to uninstall System Extension without prompting the user for authorisation. These are ways I found to uninstall System Extension The deactivationRequest api prompts the user for uninstalling System extension. If I use Apple script to drag and drop the application[which is embedded with System Extension] to trash also prompts the user. The only workaround that doesn't prompt is by disabling SIP and using the systemextensionsctl uninstall command. I want to know if there's any other solution that can uninstall System Extension without prompting the user for authorisation. Thanks!

I explored Apple's Filtering Network Traffic sample. I noticed for me, FilterDataProvider's startFilter method is called only when I make filterManager.grade = .inspector before calling filterManager.saveToPreferences. Could someone help why the startFilter is not called when I leave the filterManager's grade property with it's default value. i.e NEFilterManagerGradeFirewall? https://developer.apple.com/documentation/networkextension/filtering_network_traffic

By calling the deactivationRequest from the main app bundle, we see Privacy & Security prompts for TouchID to deactivate the System Extension. We want to know if there's way to avoid that prompt. And also need know why the prompt pops up to deactivate our own app's System Extension component. We even tried to call the deactivate request from Daemon which contain the root access. We still see the prompt. https://developer.apple.com/documentation/systemextensions/ossystemextensionrequest/deactivationrequest(forextensionwithidentifier:queue:)

I tried to unit test the method "FilterDataProvider.handleNewFlow" from the sample project https://developer.apple.com/documentation/networkextension/filtering_network_traffic I always get this below issue, Undefined symbols: Linker command failed with exit code 1 (use -v to see invocation) Could someone help with it?

Hey team, We have a use case where we need to block all the MacOS network traffic except our app's network traffic. But I don't find any apis from apple with that capability. I see using NEFilterSettings, we can allow the required endpoints and block all the other endpoints we get from handleNewFlow(_ flow:. But this api has a control in endpoint level not the app level. Could you suggest if we have any other apis for this use case? Thanks