This article helps you overcome Bitdefender Antivirus for Mac installation issues where the message « Allow Bitdefender SRL » does not appear in the Security & Privacy window.
ⓘ Note: This article applies to macOS High Sierra, Mojave, Catalina and newer versions.
When you install Bitdefender Antivirus for Mac for the first time, you should receive the notification below.
The notification appears because of a new security feature introduced with macOS 10.13 High Sierra (additional info available here). Thus, whenever a third-party application that uses kernel extension is installed, a system notification will be displayed informing the user that the kernel extension was blocked. This applies to the Bitdefender installation as well.
Bitdefender will display its own window that will guide the user through all the necessary steps to approve the Bitdefender kernel extensions. These Bitdefender kernel extensions are essential in protecting your data. Following the instructions in the window displayed by Bitdefender, you will reach the window below, which presents you with the option to Allow the Bitdefender kernel extension. By clicking Allow, you will complete the Bitdefender installation steps, and you will benefit from the full Bitdefender Antivirus for Mac protection.
In some cases, you might encounter one of the situations below:
A. You click the Allow button, but nothing happens.
B. There’s no message and no Allow button.
This usually happens after an unsuccessful OS update/upgrade. An important note here is that these situations may occur with any 3rd party application, not just with Bitdefender. This means that the troubleshooting steps will address the system, not the application per se.
How can we be sure that it’s not a Bitdefender-related issue, but a system situation? We’re going to need to type in a few commands in Terminal, a very useful utility that comes with macOS. This can be found at /Applications/Utilities. Don’t worry if you’re not familiar with the Terminal, we will get you through each command:
Step 1
The first step you want to do is to check that the Bitdefender kernel extensions were copied to the default path during the installation. For this, we will use the list command in Terminal:
LS /Library/Extensions/
These commands will display the extensions from /Library/Extensions. You should see these extensions:
SelfProtect.kext
FileProtect.kext
TMProtection.kext
If they are not there, then the installation may have been incomplete or unsuccessful. Please go here to see how to install Bitdefender.
Step 2
The second step is to check if the extensions are already loaded so we’re going to use the kextstat command.
kextstat | grep ender
This command displays all kext extensions (organized by ender meaning that the word has ender from Bitdefender on it) that contain the group of letters “ender” (from Bitdefender). We expect to find the same extensions from step 1. If they’re displayed, it means they’ve already been loaded and allowed. In this case, the Allow button should no longer appear, because you already approved them.
If you do not see anything listed, it means that the Bitdefender kext extensions were not loaded. So we’ll proceed to step 3.
Step 3
Try to load the extensions, using the kextload command in the Terminal:
sudo kextload /Library/Extensions/ FileProtect.kext/
sudo kextload /Library/Extensions/SelfProtect.kext/
sudo kextload /Library/Extensions/TMProtection.kext/
ⓘ Note: When prompted to add the password, type your admin password and press enter. No feedback will be displayed.
If the extensions are loaded, reboot your Mac and check if you still receive the notification.
If you receive an error like the one below (please note that other errors might occur, usually from typos. In this case, please correct the typo and enter again the command or use copy-paste).
If this message appears, please continue with the kextutil command:
sudo kextutil /Library/Extensions/FileProtect.kext/
sudo kextutil /Library/Extensions/SelfProtect.kext/
sudo kextutil /Library/Extensions/TMProtection.kext/
Kextutil will display more details regarding the reason of the loading error. Now it’s time for step four.
Step 4
This command is a little longer, but you can just copy it from here.
sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy “select * from kext_policy”
This command will interrogate the database that contains information about the kernel extensions. More exactly, during the installation, the kernel extensions are copied to /Library/Extensions (what we checked at Step 1) and loaded (what we checked at steps 2-3). When the system receives the request to load the kernel extension, it doesn’t load them right away. It first adds them to this database and considers them untrusted. Then, the system prompts the user with a message informing them about the kernel extension that was trying to load.
At the same time, the Allow button will be displayed in the Gatekeeper section of System Preferences.
Getting back to the command above, it should display all the extensions that were added to the database. How can we read this? It’s simple. You can easily observe that each line contains information about a certain item (kernel extension) in the table. The line is split into a few groups delimited by the | character. So, we have the following groups:
• The team_id
• The bundle_id
• The allowed Boolean
• The developer name
• The flag
From these we’re going to look at the first three:
• Each developer has a unique team_id. Bitdefender’s team_id is GUNFMW623Y
• Each kext is described by a bundle_id: e.g. com.bitdefender.FileProtect
• The allowed Boolean tells us if the kext was allowed(approved) by the user or not. 1 means it’s been approved, 4 means it needs approval. These are the main values of interest in this situation.
Now, if you see the Bitdefender extensions with the value 1, it means they’ve already been approved and that’s ok.
If the extensions still can’t be loaded, then please contact our support team.
If the value is 4, it means that the Allow button should be displayed and you should be able to click it.
If the value is 4 but the Allow button doesn’t appear in the Gatekeeper section or it appears but cannot be clicked, then this might be a system issue.
Also, if you encounter errors while trying to interrogate the database, it means the database was affected during a system update and it’s not readable anymore.
Step 5
If everything is OK until step 4, but the Allow button still doesn’t appear or doesn’t work, there’s one more command we need to try:
sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy “select * from kext_load_history_v3”
This is a database that keeps the history of the loaded extensions. Any errors that may appear indicate a malfunction of the database (same as with the database at Step 4)
Remember our question at the beginning – How can we be sure it’s a system-related issue? Now we have enough evidence to draw a conclusion. After getting to the core of it, we can try some troubleshooting methods:
- One of the simplest solutions is to reset the NVRAM. Here you can find out how to do that.
- Other solutions might be more complicated. In this regard, we recommend you contact Apple Support.
If you have any questions about Bitdefender, please check our other articles or contact our support team.