Disable Mac OS X Keyboard (built-in only)

unload-keyboard

#!/bin/bash

# Unload the keyboard so I can use my external keyboard
# and not worry about accidentally pressing buttons on
# the built-in. This may not be a problem for you but, you
# should see my desk sometimes (Oh no!!) ;-)

sudo kextunload /System/Library/Extensions/AppleUSBTopCase.kext/Contents/PlugIns/AppleUSBTCKeyboard.kext/

• Unload native keyboard: sudo kextunload -v 5 /System/Library/Extensions/AppleUSBTopCase.kext/Contents/PlugIns/AppleUSBTCKeyboard.kext/
• Reload native keyboard: sudo kextload -v 5 /System/Library/Extensions/AppleUSBTopCase.kext/Contents/PlugIns/AppleUSBTCKeyboard.kext/

This does work on new versions of MacOS, but only when System Integrity Protection (SIP) is not affecting the context. SIP was introduced in El Capitan and got some upgrades in Mojave, so all newer MacOS will have this enabled: csrutil status

• On El Capitan, Sierra and High Sierra, the kernel extension changes will throw an error due to some perms being protected, but the keyboard disabling does work
• On Mojave, Catalina, Big Sur (and beyond), SIP protections won't even let a sudoer see com.apple.driver.AppleUSBTCKeyboard, so the kextload finds nothing to unload

if you're on Mojave and above, running csrutil disable would "fix" the issue, but there are three caveats:

1. SIP can't be disabled from the active OS instance itself, so the easiest solution is to boot from the recovery partition (cmd + r on boot) and run csrutil disable from there
2. You must re-enable (via kextload) your built-in keyboard, or use a non-bluetooth keyboard, if you want to enter recovery mode at a later date, after disabling your keyboard with kextunload
3. You are disabling MacOS's native protections for system-level directories, which technically would allow a 3rd party service to inject malicious code in a number of ways. Technically the app would need sudo permissions first to do that though. This is easy enough to protect and manage on a *nix server somewhere because you (should) have protections in place and a strict policy on who can su or sudo and when. But on an os with a GUI, with applications being closed, opened, installed, etc. constantly, it's not so easy to ensure something doesn't slip in.

---

TBD:

• Is there a way to limit SIP's strictness without reboot/recovery (like selinux config)? The answer is a soft "no" per the official docs. But there is an interesting output of System Integrity Protection status: enabled (Custom Configuration). This could suggest that it may be possible to selectively disable SIP features and set a custom config, but no suggestion on how this could be done is exposed in the docs. If someone knows more about this, lmk (/usr/bin/csrutil is a binary in mach-o format by the way)
• How do 3rd parties like Karabiner-Elements accomplish disabling the keyboard? Perhaps they don't even need to touch the kernel extensions. It was implemented in this issue, v0.90.63, but I can't find a release with that tag so I don't see the commit. Searching through the codebase doesn't show anything too obvious re: kext. Any insight on that would be helpful too.