(SQLITE3/KEXT) Want to revoke my MacOS trust on installer, so it prompts me again about allowing what I previously allowed (and don't want to now)

Question

This was the best I found, but seemed, some things out of my scope, and other that worked in the text, didn’t worked for me like the “Error: stepping, attempt to write a readonly database (8)” that I got mimicking the answer:

https://apple.stackexchange.com/questions/382216/revoke-permission-to-run-third-party-kernel-extension

Also the “parallel” thing:

“If you wanted to delete all of them you could use delete from kext_policy; then to be tidy delete from kext_load_history_v3; Alternatively you can delete a specific one by comparing one of the fields shown by the .schema command. For example to delete LittleSnitch based on the second field bundle_id;”.

My try (is about an external SSD drive [I know how to unload/remove the kext driver, that was easy, but not to make my MacOS feel again all the reinstallation as an strange: if I reinstall the app [is a pkg], after the very first allowance, now goes all the way down without demanding the original System Preferences > Allow external developer… classic step, that I guess we all experienced many times]):

% sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy
Password:
SQLite version 3.37.0 2021-12-09 01:34:53
Enter ".help" for usage hints.
sqlite> SELECT * FROM kext_policy;
(NOT SHOWED ENTRY, FOR PRIVACY AND CLARITY)
(NOT SHOWED ENTRY, FOR PRIVACY AND CLARITY)
…
(NOT SHOWED ENTRY, FOR PRIVACY AND CLARITY)
8S33FS7Q5Q|com.samsung.portablessd.driver|1|Samsung Electronics|1
sqlite> DELETE FROM kext_policy_mdm WHERE team_id = '8S33FS7Q5Q';
Error: stepping, attempt to write a readonly database (8)
sqlite> DELETE FROM kext_policy WHERE bundle_id = "com.samsung.portablessd.driver";
Error: stepping, attempt to write a readonly database (8)
sqlite> SELECT * FROM kext_load_history_v3;
/Library/Extensions/….
(NOT SHOWED MANY ENTRIES, FOR PRIVACY AND CLARITY)
(NOT SHOWED MANY ENTRIES, FOR PRIVACY AND CLARITY)
…
(NOT SHOWED MANY ENTRIES, FOR PRIVACY AND CLARITY) 
/Library/Extensions/SamsungPortableSSDDriver.kext|8S33FS7Q5Q|com.samsung.portablessd.driver|9DE8C72F-E1AF-4F8B-B30F-B48A1C80689B|2023-02-14 19:26:33|2023-02-14 20:46:36|53|ec8fafd76e3a5741b388e75ead49c896dfe96186
sqlite> 

And what about the “PRAM” component of this thing? (I am still studying tons of things before diving into MacOS internals, looks for me overwhelming… Like “obscure” permissions interdependencies… Things not documented, protected from non-propietary eyes? Sure this is an ultra-biased sensation. But a little light would be gold for me. Something to get a little bit oriented (starting with this direct question about how revoking 3rd-party-installer-id-vendors during software installation (basically I want the pop-up window again prompting for a password to install drivers and having to allow it on the classic System Preferences clicking on “Allow”).

I am also a little bit afraid of touching what I should not (like naively using, who knows? A chmod transforming a read-only thing [the database, for example] that should be protected read-only thinking that would be a very harmless action, but perhaps was the opposite), by just pretending revoking a very simple thing.

Advice would be gold. Thank you. Hoping is a good and challenging question.

Answer 1

Directory containing the database is protected by SIP (xattr -l /var/db/SystemPolicyConfiguration)
(That is why it can't be modified in an ordinary booted environment).

Want to be able to write to it? You can disable SIP entirely. (Perhaps, you can also make modifications from a recovery boot).


Want to modify the file? Need to disable SIP. (Shortcut: zapping PRAM is a quick way to turn SIP back on after disabling it, rather than booting again to the recovery environment).

How to ‘turn off SIP’ (from AppleDeveloper page):

Disabling and Enabling System Integrity Protection

Disable system protections only temporarily during development to test drivers, kernel extensions, and other low-level code.

Overview

System Integrity Protection (SIP) in macOS protects the entire system by preventing the execution of unauthorized code. The system automatically authorizes apps that the user downloads from the App Store. The system also authorizes apps that a developer notarizes and distributes directly to users. The system prevents the launching of all other apps by default. During development, it may be necessary for you to disable SIP temporarily to install and test your code. You don’t need to disable SIP to run and debug apps from Xcode, but you might need to disable it to install system extensions, such as DriverKit drivers.

Disable System Integrity Protection Temporarily
To disable SIP, do the following:
1 Restart your computer in Recovery mode.
2 Launch Terminal from the Utilities menu.
3 Run the command csrutil disable.
4 Restart your computer.

Warning
Disable SIP only temporarily to perform necessary tasks, and reenable it as soon as possible. Failure to reenable SIP when you are done testing leaves your computer vulnerable to malicious code.
Enable System Integrity Protection
To reenable SIP, do the following:
1 Restart your computer in Recovery mode.
2 Launch Terminal from the Utilities menu.
3 Run the command csrutil enable.
4 Restart your computer.

(from this link: https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection?language=objc)




(From comments: deleting entries on that table will only affect third party drivers. It's really guesswork as to how this might affect your system when the driver is not loaded as a result. It's highly unlikely to cause irreversible harm as you can simply attempt to load any driver you may have turned off as a result of playing with this file, and it only affects non-apple supplied kexts. Anything beyond that is pure conjecture).

[answer from comments summary, thanks to the main commentator. This is the abstract. Completed with AppleDeveloper page information].