What is /Library/StagedExtensions for and how to remove extensions [closed] - kernel-extension

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 2 years ago.
Locked. This question and its answers are locked because the question is off-topic but has historical significance. It is not currently accepting new answers or interactions.
I'm trying to uninstall Parallels completely from macOS High Sierra.
I removed everything from the disk except some Parallels extensions that are stored under /Library/StagedExtensions/Parallel Desktop.app
I think the location has to do with user approved extensions, but I'd like to find a way to remove/uninstall those too. If I try to delete the extensions it says operation not permitted despite the root rights.
Any idea?

Answer 1

There is new way to clear the StageExtensions folder as following
sudo kextcache --clear-staging
This command will clear the /Library/StageExtensions folder. We dont need to go to recovery mode and delete manually this folder in case there are some permission errors while installing software.

Answer 2

In my case, deleted kext disappears from StagedExtensions when you invalidate kext cache.
sudo rm -rf /Library/Extensions/Parallel\ Desktop.app # check if the name is correct so you don't delete some other kext
sudo kextcache -invalidate /
# now you should not see your deleted kext here
ls /Library/StagedExtensions/
UPDATE 2019:
See man page for full details: man kextcache.
Excerpt related to -invalidate, -i for short:
-i os_volume, -invalidate os_volume
Rebuild out-of-date caches and update any helper partitions
associated with os_volume.
This option mimics sudo touch /System/Library/Extensions on
os_volume. If kextcache cannot find or make sense of
os_volume/usr/standalone/bootcaches.plist, the volume is treated
as if no caches need updating: success is returned.
There are also new options:
-clear-staging
Clears the kernel extension staging area by removing all staged content.
-prune-staging
Prunes the kernel extension staging area by removing all kernel extensions
no longer present in their original location.
Looks like -prune-staging removes only the deleted extensions, shaving little bit of time from the next kext cache rebuild.
See https://www.unix.com/man-page/mojave/8/KEXTCACHE/ for Mojave man page, which contains these new options.

Answer 3

sudo kextcache --clear-staging
Was in folder HD/Library/
Cheers
Edit: Formatting
Edit2: I believe that Parallels writes some files directly into the bootloader/kernel. After running the command from the CMD+R hold restart Disk Utility Terminal the extension was removed from /Library .
I hope this makes sense.

Answer 4

I had a similar issue in trying to uninstall the TelestreamAudio.kext for ScreenFlow. What might be happening is that the kext in StagedExtensions is currently in use or protected while you're in regular mode. Once you get into Recovery mode, you can delete it without disabling System Integrity Protection. The following steps worked for me, though please use caution.
Click the  menu. Select Restart
Hold down command-R to boot into the Recovery System
Choose Disk Utility from the Recovery Menu
Within Disk Utility click on your main hard drive (e.g. Macintosh HD) and then click on Mount
Exit out of Disk Utility
Click Utilities in the menu bar and select Terminal
Use the following commands:
.
cd /Volumes/Macintosh\ HD/Library/StagedExtensions/Library/Extensions/
rm -rf NAME_OF_EXTENSION.kext
Close the Terminal app
Click the  menu and select Restart
From there on, I was able to reinstall ScreenFlow's audio kext and it worked. It may also help you completely remove the Parallels kext.

Answer 5

If you've already deleted the extensions from /Library/Extensions, open the Terminal app from Launchpad, copy/paste the command below and press Enter to run it:
sudo kextcache -prune-staging
As mentioned in another comment, this will only remove the kernel extensions that are no longer present in their original location, i.e., /Library/Extensions.
The extensions you deleted from /Library/Extensions will then disappear from /Library/StagedExtensions/. It won't affect your other kernel staged extensions.
/Library/StagedExtensions/ is an intermediate area where your extensions live after you start your session (like a cache). The staging area won't be immediately affected if changes are made to /Library/Extensions, which I believe is meant to improve stability and security.

Answer 6

This is because of the System Integrity Protection (SIP).
You can disable it (not recommended) and remove the kext manually.
(from https://www.imore.com/el-capitan-system-integrity-protection-helps-keep-malware-away)
Click the  menu. Select Restart...
Hold down command-R to boot into the Recovery System.
Click the Utilities menu and select Terminal.
Type csrutil disable and press return.
Close the Terminal app. Click the  menu and select Restart....
If you decide later you want to re-engage SIP (and I earnestly hope that you do), repeat these steps, use csrutil enable instead.