ext4 without macFUSE or a kernel extension

Kernel extensions and Reduced Security

A kernel extension – a kext – is code loaded into the macOS kernel itself. Paragon extFS is one, and so is macFUSE's default backend. Apple has deprecated kernel extensions, and its security guide says they are no longer recommended for macOS.

On a Mac with Apple silicon, a third-party kernel extension doesn't load at all until you change the Mac's security policy:

• Shut the Mac down, then press and hold the power button until “Loading startup options” appears, and choose Options.
• In Recovery, choose Utilities › Startup Security Utility, pick the startup disk, and set its Security Policy to Reduced Security with “Allow user management of kernel extensions from identified developers”. Restart.
• Approve the extension in System Settings › Privacy & Security, and restart once more.

Reduced Security does more than admit kernel extensions. It lets the Mac start any version of signed macOS Apple ever trusted, where Full Security allows only the current one – and Apple's deployment guide notes that “older versions of macOS inevitably have unpatched vulnerabilities”, advising Reduced Security only for those who depend on legacy kernel extensions. Its security guide adds that with third-party kernel extensions loaded, Apple Pay may not be possible.

macOS 27 runs only on Macs with Apple silicon, so on macOS 27 every kernel-extension route to ext4 goes through all of this, on every Mac.

What FSKit changes

FSKit, added in macOS 15.4, lets a file system run as an app extension, outside the kernel. It is how Apple ships its own newer drivers: on macOS 27, exFAT, FAT and FTP are FSKit modules inside the system. A third-party FSKit file system comes in an ordinary app, from the App Store if its maker likes.

macOS still keeps it off until you say otherwise – but that is one switch in System Settings › General › Login Items & Extensions › File System Extensions, with no trip to Recovery and no change to the Mac's security policy.

macFUSE today

macFUSE 5.5.0, from October 2026, runs on macOS 12 and later, Apple silicon or Intel, macOS 27 included. It brings no file system of its own – that is the job of a FUSE file system on top. It has two backends:

• The kernel extension, used unless a file system asks otherwise. It is the faster and fuller of the two, and on Apple silicon macFUSE's own guide tells you to set Reduced Security for it.
• The FSKit backend, experimental since macFUSE 5.0 (May 2025), for macOS 15.4 and later. A file system opts in when it mounts, with -o backend=fskit, and then needs no kernel extension and no change to the Mac's security. macFUSE's wiki lists what it can't do yet: the FUSE notification API, most of the mount options the kernel used to handle, and I/O as fast as the kernel extension's. Read-only FSKit mounts need macOS 26.4.

Neither ext4fuse nor fuse-ext2 says whether it works on the FSKit backend: both last changed before it existed.

Why ext4fuse is a dead end

macFUSE is a layer: it needs a file system on top, and for ext4 the guides name ext4fuse or fuse-ext2.

• ext4fuse only ever read ext4. Its last change is from September 2020, and Homebrew's formula says it requires Linux and is deprecated as unmaintained, to be disabled in June 2027 – so the brew install ext4fuse in many guides doesn't give you a working driver on a Mac.
• fuse-ext2 writes, but its README warns against mounting with write support unless you have nothing to lose. Its last release is a pre-release from January 2024.

ext4 without a kernel extension

What each one reads and writes, what it costs and what it does with the journal: every way to read and write ext4 on a Mac, compared.

Moving to Extent

1. 1

   Install Extent and turn on its extension, once

   Extent is free on the Mac App Store. Switch it on in System Settings › General › Login Items & Extensions › File System Extensions; the banner in Extent's window opens that pane for you.

2. 2

   Remove the ext4 driver you had

   A kernel extension gets a disk before any FSKit file system does, so with Paragon extFS installed, its driver keeps mounting your ext4 disks. Extent's window names the driver that took a partition. Uninstall the old driver as its maker describes.

3. 3

   Go back to Full Security, if nothing else needs Reduced

   Only if no other kernel extension on the Mac needs it: start up into Recovery the same way, open Startup Security Utility and choose Full Security, which runs only the current macOS or signed software Apple currently trusts.

4. 4

   Plug in the disk

   It mounts read-only in the Finder. Writing to ext4 is a one-time purchase and a switch per disk.

Frequently asked questions