1 3 4 5 6 7 Previous Next 168 Replies Latest reply: Sep 8, 2013 9:10 AM by MadMacs0 Go to original post
  • 60. Re: crsud process with security update 2013-001
    andyBall_uk Level 7 Level 7 (20,320 points)

    use Findanyfile as root (option click the Find button) or peek in

    /private/var/root/Library/Caches/crsud

    if not there, yours is different

  • 61. Re: crsud process with security update 2013-001
    WZZZ Level 6 Level 6 (12,225 points)

    I use EasyFind. All I have for crsud is

     

    /System/Library/LaunchDaemons/com.apple.crsud.plist

     

    /usr/libexec/crsud

     

    /private/var/db/install/crsud.plist

     

    If I use Go to folder for  /private/var/root/Library/Caches/crsud  I get folder not found. If I enter just /private/var/root I don't have permission to see its contents.

     

    If I enter sudo open /private/var/root/Library/Caches/crsud nothing happens.

     

    But even if I just enter sudo open /private/var/root/ I get a Preview root folder showing with no access. I would have thought sudo open would blow away all ACLs. I guess it doesn't.

     

    I'm going to try to set up EF with root privileges.

  • 62. Re: crsud process with security update 2013-001
    andyBall_uk Level 7 Level 7 (20,320 points)

    use sudo ls,or cat/less if you want to see the cache.db content

    FaF makes it very easy, I use both that & EF

     

    even Devon suggest it " Alternative: Feel free to have a look at Thomas Tempelmann's Find Any File. In contrast to EasyFind you'll get a hierarchical result list, you can search as "root" user, search after date ranges and file sizes, and save searches and re-run them later." although I'd expect that EF can be usefully run via sudo, like disk usage apps.

  • 63. Re: crsud process with security update 2013-001
    WZZZ Level 6 Level 6 (12,225 points)

    Thanks for the suggestions. I have FAF, just never use it or got used to it.

     

    Anyway, with EF with admin priviliges, I can search root. I still can't open that folder from there, but it's there alright.

     

    I'm seeing it was modified yesterday also.

     

    Will have a look with FAF too.

  • 64. Re: crsud process with security update 2013-001
    WZZZ Level 6 Level 6 (12,225 points)

    Tried FAF with root. No dice. I don't need a full FAF tutorial--I can find that elsewhere--but you might want to suggest what I'm doing wrong  here. Tried almost all the different choices in the dropdown from "contains phrase") Thanks.

     

    Screen shot 2013-03-22 at 10.21.24 AM.png

  • 65. Re: crsud process with security update 2013-001
    andyBall_uk Level 7 Level 7 (20,320 points)

    I used name contains:crsud

    no other choices

  • 66. Re: crsud process with security update 2013-001
    WZZZ Level 6 Level 6 (12,225 points)

    That did the trick. Thanks.

  • 67. Re: crsud process with security update 2013-001
    WZZZ Level 6 Level 6 (12,225 points)

    Btw, never bothered with FAF before. I set up a script to run EF as root, but now that I know that FAF can easily be set to search root, that will be even easier and very useful at times.Thanks again for the tip.

  • 68. Re: crsud process with security update 2013-001
    Michael Schmitt Level 1 Level 1 (40 points)

    Lion has System Preferences > Security & Privacy > Advanced > Automatically install important security updates.

     

    The clues would imply that crsud runs every 4 hours to check for the important security updates.

     

    My guess is the name stands for CRitical Security Update Daemon.

  • 69. Re: crsud process with security update 2013-001
    ds store Level 7 Level 7 (30,305 points)

    Michael Schmitt wrote:


    The clues would imply that crsud runs every 4 hours to check for the important security updates.

     

    I have Little Snitch asking for crsud, it seems to go by the time and date as if it didn't run it will try during log-in time, but not all the time, else it asks about once day or so, I think it's like every 26 hours or so.

     

    This is 10.6.8, might be more often on the Lions.

  • 70. Re: crsud process with security update 2013-001
    Michael Schmitt Level 1 Level 1 (40 points)

    It's scheduled to run every 4 hours in Snow Leopard, but Snow Leopard only counts awake time.

  • 71. Re: crsud process with security update 2013-001
    ds store Level 7 Level 7 (30,305 points)

    Michael Schmitt wrote:

     

    It's scheduled to run every 4 hours in Snow Leopard, but Snow Leopard only counts awake time.

     

     

    It might be running every four hours, but it's  checking for updates every 20 something hours unless it missed it, then it will check for updates  upon login time.

     

    If it checked for updates every four hours, it would have bugged the crap out me  as I watch all my network connections.

  • 72. Re: crsud process with security update 2013-001
    MadMacs0 Level 4 Level 4 (3,735 points)

    Michael Schmitt wrote:

     

    The clues would imply that crsud runs every 4 hours to check for the important security updates.

    We can settle this really quick if somebody will post the contents of /System/Library/LaunchDaemons/com.apple.crsud.plist

  • 73. Re: crsud process with security update 2013-001
    WZZZ Level 6 Level 6 (12,225 points)

    <?xml version="1.0" encoding="UTF-8"?>

    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    <plist version="1.0">

    <dict>

        <key>StartInterval</key>

        <integer>14400</integer>

        <key>RunAtLoad</key>

        <true/>

        <key>Label</key>

        <string>com.apple.crsud</string>

        <key>OnDemand</key>

        <true/>

        <key>Program</key>

        <string>/usr/libexec/crsud</string>

        <key>UserName</key>

        <string>root</string>

    </dict>

    </plist>

     

    Must be every four hours of actual running time. I've since allowed it in Little Snitch to run behind the scenes. But before I did, I'm pretty sure I wasn't being prompted to allow every four hours, even of running time.

     

    I'd still love to see this thing bring over an actual update. Would that go to XProtect or what? Since XProtect is already set to bring things over on a regular basis, I'm still puzzled what this thing actually does. Hard to imagine it silently installing a security update, since those have always required a restart. No one seems to have figured this out; all the hits I get for crsud are from around 3/15, when this thing first appeared.

     

    Message was edited by: WZZZ

  • 74. Re: crsud process with security update 2013-001
    MadMacs0 Level 4 Level 4 (3,735 points)

    I'm possibly the least qualified person to be commenting on this having leapfrogged from Leopard on PPC to Mountain Lion on an i7, so I can't check anything to do with Lion or SL. It is clear, though, that different OS's are handling it with slight differences.

     

    My XProtect option is here

    ML Sec&Priv Adv.png

    as it apparently is for Lion. The Help Center goes on to say:

    Automatically update safe downloads list

    Apple keeps an updated list of malware that may try to compromise the security of your computer. Your computer is set, by default, to automatically update this information with the latest available.ut the "Automatically install security updates" option is in Software Updates and is labeled "Install system data files and security updates".

    But the "Automatically install important updates" for me has been moved to Software Update and reworded as "Install system data files and security updates"ML SoftUpdt.png

    and the Help Center says:

    Automatically install system data files and security updates

    Select the checkbox to have your Mac install system files and security updates automatically.

    WZZZ wrote:

     

    Must be every four hours of actual running time.

    Did I read earlier that SL handles "StartInterval" differently than Lion & ML?

    Would that go to XProtect or what? Since XProtect is already set to bring things over on a regular basis, I'm still puzzled what this thing actually does. Hard to imagine it silently installing a security update, since those have always required a restart. No one seems to have figured this out; all the hits I get for crsud are from around 3/15, when this thing first appeared.

    I doubt that it's at all connected with XProtect, for as you say that's already on a 24-hour basis and is apparently always on now for SL users. In order to test it you would have to have the crsud option disabled and wait for the next XProtect update to know for certain. If it didn't happen within 24 hours (clock time or run time?), then you would need to try toggling it to see if they are connected.

     

    In Lion and ML it's obviously controlled by different processes.

1 3 4 5 6 7 Previous Next