GlobalProtect and OS X 10.10 (Yosemite)

[sd@censhare.com]

Hello,

some of my colleagues are testing OS X 10.10 and the global protect client does not work. I read that Apple changed something with their signatures and when I take a look into the info.plist of the GlobalProtect Client it looks like this software is build with 10.6

# less /Applications/GlobalProtect.app/Contents/Info.plist

....

<key>DTSDKName</key>

    <string>macosx10.6</string>

....

http://fairerplatform.com/2014/08/apples-os-x-yosemite-code-signing-letter-devs/

"...If you build code with an older version of OS X, use OS X Mavericks 10.9 or later to sign your app and create v2 signatures using the codesign tool..."

Tried to start the kernel extension with 10.10

Aug 11 11:59:41 mbpro-hm.local PanGPS[914]: PanGPS starts

Aug 11 11:59:41 mbpro-hm.local com.apple.kextd[19]: ERROR: invalid signature for com.paloaltonetworks.kext.pangpd, will not load

With 10.9.4 or below

sudo kextutil /Applications/GlobalProtect.app/Contents/Resources/pangpd.kext

Diagnostics for pangpd.kext:

Code Signing Failure: code signature is invalid

kext com.paloaltonetworks.kext.pangpd  100009000 is in exception list, allowing to load

kext com.paloaltonetworks.kext.pangpd  100009000 is in exception list, allowing to load

Does somebody know something about a new version for OS X 10.10 (!! 10.9.5 will be affected too)?

Thanks

Stephan

[_slv_ · Accepted solution]

Hi

Official reply is (taken few days ago from community, but now I cn't find this message):

GlobalProtect Client Does Not Work with Mac OS X 10.10 (Yosemite)

stworzony przez sjamaluddin dnia 2014-07-28 16:07, ostatnia modyfikacja wykonana przez panagent dnia 2014-07-28 16:49

Wersja 6

For Internal Use Only

Issue

Apple released a new version of the Mac OS (10.10 - Yosemite). This version, though still in beta, is available to the public. Many people have installed and are using Mac OS X Yosemite already.

Our GlobalProtect clients (1.x. and 2.0.x) currently do not work with Mac OS X. (10.10).

Resolution

Engineering is working to update the GlobalProtect client. Until the release of the updated client, consider the following workaround:

Users may return to Mac OS X 10.9 behavior with kernel modules by running the following command in Terminal:

$ sudo nvram boot-args="kext-dev-mode=1"

Then, reboot the Mac.

Note: The above command must be executed by a user with administrative privileges. The command will prompt for the user's password.

The workaround will be in effect until the next 2.0.x release of the GlobalProtect client.

[sd@censhare.com]

Hi,

sorry that I created a similar post but I did not find any information about it either too.

Thanks for the workaround, it will work for those who can not wait until PaloAlto released a version for 10.10.

Thanks

Stephan