[Kickaha]

Well, I updated my MacBook this morning, and of course I didn't back up beforehand this time, because... there's big trouble in River City.

I can Safe Boot, but if I attempt to boot normally, I get a lovely circle-with-slash logo after a while, and if I boot into single user mode, I get an error that the kext com.apple.IOStorageFamily cannot be loaded. Awesome. System Profiler lists its Authentic status as No, which tells me it's likely hosed. Disk checks out with Disk Utility.

Looked up the all new Snow Leopard way of handling Receipts, which is to hide them away in /private/var/db/receipts... apparently SecurityUpdate2010-001 doesn't touch the file that is now borked. Odd.

Hints? Safe Boot should have blown away the kext cache, in case that's mangled.

[bassplayinMacFiend]

Can you extract the file from your OS DVD and reinstall?

Alternatively, can you find if it has been updated with any point release? Then you could download the combo updater and extract the kext from the .pkg?

[Kickaha]

Yeah, that's what I'm going to have to do, I fear. Worst case, I can pull it over from the mini running 10.6 when I get home.

[ShadowOfGed]

sudo kextutil --verbose -t /System/Library/Extensions/IOStorageFamily.kext

Should tell you what's wrong with it. I seem to recall seeing a Disk Warrior resource/icon migrate its way into a kext once, which will invalidate its "authenticity" (a non-root-owned file gets in). The problem is, this can happen long before the Security Update was installed, but it just doesn't burn you until a reboot.

I bet you can just remove a rogue file or fix incorrect permissions in there. Just a thought.

[Kickaha]

Nice!

Authentication Failures:     File owner/permissions are incorrect (must be root:wheel, nonwritable by group/other):         /backupkext/IOStorageFamily.kext/Contents/Resources/Preview.icns

Twas indeed the silly icon. Copied the kext over from another machine, and it works fine, and authenticates.

[ShadowOfGed]

Originally Posted by Kickaha Nice! Authentication Failures: File owner/permissions are incorrect (must be root:wheel, nonwritable by group/other): /backupkext/IOStorageFamily.kext/Contents/Resources/Preview.icns Twas indeed the silly icon. Copied the kext over from another machine, and it works fine, and authenticates.

Out of curiosity, whose ICNS was it?

[Kickaha]

Drive with a magnifying glass on it. No copyright info. Last modified Apr 29, 2005. Strange. I think your DiskWarrior hunch might be spot on, but I can't recall the last time I used it - and I normally don't install the sentry bits. Hmm.

Does not exist in fresh copy from 10.6 install.

So the questions are - whose is it (although I think you're right), and why did it not cause a problem until *now*? New security protocol get tripped?

[ShadowOfGed]

Originally Posted by Kickaha Drive with a magnifying glass on it. No copyright info. Last modified Apr 29, 2005. Strange. I think your DiskWarrior hunch might be spot on, but I can't recall the last time I used it - and I normally don't install the sentry bits. Hmm. Does not exist in fresh copy from 10.6 install. So the questions are - whose is it (although I think you're right), and why did it not cause a problem until *now*? New security protocol get tripped?

Nope, but that is DiskWarrior's icon. I just wanted to make sure it was the same one I'd heard about before. Kernel extensions have always had strict permissions checks (for obvious reasons). What I never did figure out is how or why the icon landed there. Though it looks like their DiskWarriorPreviewDriver.kext has some suspicious bits in its Info.plist.

[Kickaha]

Interesting, that kext is nowhere on my system that I can find.

Wow. I had this exact problem, and replacing my IOStorageFamily.kext from a backup I made recently solved the problem. Thank you all for your help! I had run an old version of DiskWarrior a few days ago trying to help my brother-in-law recover data off of a failed hard drive. My machine froze up today, and then wouldn't reboot, showing the circle/slash icon at startup. My kext was non-authentic as well and had the icns in it also. I am so relieved I don't have to reinstall the OS... Thanks again!

Just had to join the forum to thank you for this discussion. Saved my bacon, and made me distrustful of DiskWarrior. Has anybody figured out why it was happening, and whether anybody has resolved the problem?