MacFUSE/VeraCrypt not working with OS13 and OS14 (error = kext load failed- -603947007)

[Change Agent]

I have the following situation. I use VeraCrypt (VC) (version 1.25.9) that use MacFUSE (version 4.5.0). Presently we use OS12 (belt and braces approach learned from Apple Tech People long ago, “Never upgrade to the newest OS, let others test and wait till most bugs are out.”) and want to move to OS 13.

In order to be following the belt and braces approach I am testing all our applications on an external USB SSD connected to a M1 MBP, with the new system installed on the USB SSD. All applications work as should, except VC that use MacFUSE.

I get the flowing error that I believe is a MacFUSE error.

kext load failed- -603947007
mount_macfuse- the file system is not available (255)

I removed and installed MacFUSE, rebooted several times, checked security settings etc. all seems OK. But maybe I missed something.
We use the latest version of MacFUSE.

Does anybody have any idea as to what I am missing here or why it does not work? I see in the MacFUSE forum that it is confirmed (a different problem as mine) that MacFUSE works with OS 13 and OS 14.

 

[Honza1]

I'll ask the obvious, but likely you mean the "check security settings" that you have done this...
Since this is loading kext, system should prevent it from loading and ask for approval - and then you need to reboot again. You need to give approval to every kext separately and since you can do only one at time, it may mean few reboots... I already have macOS13, so I do not have Preferences of 12 in front of me, so this may not be precise:
There is button in Security & Settings and if there is blocked kext, there is will be something like "Allow ... kext loading" text next to it. You have to allow its loading and reboot.
If you have not done this and kext is blocked, you need to somehow trigger this dialog to be able to enable it. I am not sure how exactly, but removing the kext, reboot, and then reinstalling he kext and rebooting may do it. The system remembers if you allowed or not allowed the kext before and will not ask for the same kext multiple time.

 

[MisterSavage]

I've never seen that error before so I don't have any tips, but I've never had a problem with VC on macOS 13 (which I am still running).

 

[Change Agent]

Thanks Honza1, sorry for the delay in replying I am in a different timezone.

FTI, I am not on OS 12 but testing OS13.

Since this is loading kext, system should prevent it from loading and ask for approval - and then you need to reboot again.

At no point did it ask me for permission.

There is button in Security & Settings and if there is blocked kext, there is will be something like "Allow ... kext loading" text next to it.

I can find no such button anywhere in Security & Settings. Can you post a picture? And here I assume that when you say Security & Settings you mean Security Settings Privacy & Security.

I am not sure how exactly, but removing the kext, reboot, and then reinstalling he kext and rebooting may do it.

Neither am I. Would uninstalling MacFUSE do it?

 

[Change Agent]

I've never seen that error before so I don't have any tips, but I've never had a problem with VC on macOS 13 (which I am still running).

I know I have a MacMini with OS13 and there it runs fine.

 

[doobydoooby]

I'm running OS 13.6 on a mac pro. No problem with Veracrypt (1.24.8 or 1.26.7) or Mac fuse (4.4.1 or 4.5)

 

[Change Agent]

I'm running OS 13.6 on a mac pro. No problem with Veracrypt (1.24.8 or 1.26.7) or Mac fuse (4.4.1 or 4.5)

Thanks for the heads-up. As said I have it working fine on the MM.

 

[Honza1]

Thanks Honza1, sorry for the delay in replying I am in a different timezone.

FTI, I am not on OS 12 but testing OS13.



At no point did it ask me for permission.



I can find no such button anywhere in Security & Settings. Can you post a picture? And here I assume that when you say Security & Settings you mean Security Settings Privacy & Security.



Neither am I. Would uninstalling MacFUSE do it?

I am not sure if uninstall will actually remove the kext and trigger this question. I also do not have your version of macOS, butI Googled "how to allow kext loading" and here is web site which walks you step by step through kext approval:

Approving Kernel Extensions for macOS - IS&T Contributions - Hermes

kb.mit.edu

Hopefully that helps.

 

[Change Agent]

Approving Kernel Extensions for macOS - IS&T Contributions - Hermes

kb.mit.edu

Hopefully that helps.

thanks but that is for OS12 or earlier.

 

[Honza1]

thanks but that is for OS12 or earlier.

I misunderstood what you use. There are 10.13 instructions easy to find on line.

 

[Change Agent]

I misunderstood what you use. There are 10.13 instructions easy to find on line.

I think you still do misunderstand, your instructions are for OS12 or earlier. I am, talking about OS 13 here as in the title of the post.

 

[Honza1]

I think you still do misunderstand, your instructions are for OS12 or earlier. I am, talking about OS 13 here as in the title of the post.

I understand. Simply google "how to allow kext loading", first hit is web page from Apple which provides step by step instructions how to enable kexts. It gets bit complicated depending on your hardware and so you need to evaluate your case. First 5 links from Google contain at least 2 sets of instructions for macOS 13.x in detail. That is much better than me trying to write something here, which I may not remember correctly after ~1 year since I did it...
I think we know by now, that your problem is system blocking/not loading kexts. Finding instructuoins how to unblock them is easy once you know what to ask Google (or Bing).

 

[Change Agent]

Thanks Honza1

I had done a search like that before I posted and did it again with your sugestion and found nothing that was helpful that I had not seen before. All of it that is being suggested I had done already.

 

[cipherneo]

I have the following situation. I use VeraCrypt (VC) (version 1.25.9) that use MacFUSE (version 4.5.0). Presently we use OS12 (belt and braces approach learned from Apple Tech People long ago, “Never upgrade to the newest OS, let others test and wait till most bugs are out.”) and want to move to OS 13.

In order to be following the belt and braces approach I am testing all our applications on an external USB SSD connected to a M1 MBP, with the new system installed on the USB SSD. All applications work as should, except VC that use MacFUSE.

I get the flowing error that I believe is a MacFUSE error.

kext load failed- -603947007
mount_macfuse- the file system is not available (255)

I removed and installed MacFUSE, rebooted several times, checked security settings etc. all seems OK. But maybe I missed something.
We use the latest version of MacFUSE.

Does anybody have any idea as to what I am missing here or why it does not work? I see in the MacFUSE forum that it is confirmed (a different problem as mine) that MacFUSE works with OS 13 and OS 14.

Unfortunately as I found out with the BoxCryptor (now defunct) and now Cryptomator applications kernel extensions can not be loaded from an external drive on M* Macs. So if you are using an Apple Silicon Mac kernel extensions can only be loaded from the internal SSD even if you lower the security profile settings of the external drive to allow them. You could try fuse-t which is a kext-less, e.g. a user space kext, implementation of FUSE for macOS. Hope this helps..

 

[Honza1]

Unfortunately as I found out with the BoxCryptor (now defunct) and now Cryptomator applications kernel extensions can not be loaded from an external drive on M* Macs. So if you are using an Apple Silicon Mac kernel extensions can only be loaded from the internal SSD even if you lower the security profile settings of the external drive to allow them. You could try fuse-t which is a kext-less, e.g. a user space kext, implementation of FUSE for macOS. Hope this helps..

You learn something new every time. I was not aware kexts cannot be loaded while booting from external drive. Apple seems to be limiting ability to boot from external drive for some time and making it more challenging. It seems illogical that we can load kexts from internal and not external boot drive.
That said, Apple is making it clear that kexts will be removed soon, so we need kext-less alternatives soon.

 

[HDFan]

I use VeraCrypt (VC)

No problem with Veracrypt

Out of curiosity why do you use a 3rd party app rather than Apple native disk encryption?

 

[Change Agent]

Unfortunately as I found out with the BoxCryptor (now defunct) and now Cryptomator applications kernel extensions can not be loaded from an external drive on M* Macs. So if you are using an Apple Silicon Mac kernel extensions can only be loaded from the internal SSD even if you lower the security profile settings of the external drive to allow them. You could try fuse-t which is a kext-less, e.g. a user space kext, implementation of FUSE for macOS. Hope this helps..

interesting and thanks. I was thinking this morning that maybe it is the external SSD. I will try fuse-t and see it it works with VC.

 

[Change Agent]

BTW just talked to VC folks. They are aware of the challenge with KEXT being faded out. Here is what they wrote to me:

You're correct in your observation regarding Apple phasing out kext and
its implications for VeraCrypt's reliance on MacFUSE. The challenges
posed by these changes have been on our radar, and I'm pleased to share
that we are actively investigating alternative solutions to address this
concern.

One promising alternative that has come to our attention is FUSE-T,
which is an implementation of FUSE on macOS that doesn’t depend on a
kext. You can learn more about it here:
https://github.com/macos-fuse-t/fuse-t. We were made aware that with
minor changes, VeraCrypt can function using FUSE-T
(https://github.com/macos-fuse-t/fuse-t/issues/11#issuecomment-1320898562).
However, the specifics of these changes haven't been shared with us, so
our next step is to evaluate and thoroughly test it on our end.

Given the evolving landscape of macOS, FUSE-T seems to be a potentially
viable alternative for the future. Our goal is to ensure that VeraCrypt
remains a robust and reliable tool for macOS users, and to that end, we
are considering offering a choice between MacFUSE and FUSE-T. This might
mean providing two different packages to adapt to varying user needs and
preferences.

Thank you once again for reaching out and for your continued support of
VeraCrypt.

Thnkas to all for chipping in.

 

[cipherneo]

BTW just talked to VC folks. They are aware of the challenge with KEXT being faded out. Here is what they wrote to me:



Thnkas to all for chipping in.

FYI, fuse-t has an annoying issue wrt to maintaining file date and time caused by a bug with the Apple NFS4 implementation according to the developer. The developer implemented the "nomtime" and "noatime" NFS mount options as a way to solve the issue but IMO there are still issues with it when compared to FUSE. The developers of Cryptormator also have WebDav as a backend Finder method for mounting the Cryptomator vaults which is better than fuse-t but it too has a few issues but it's still better than fuse-t IMO. I use their WebDav option on my testing Apple Silicon Macs when booting from an external SSD. You can read about the date/time issue on the fuse-t GitHub issues web page.

 

[Change Agent]

Thanks cipherneo for the heads up.