Skip navigation

crsud process with security update 2013-001

36929 Views 168 Replies Latest reply: Sep 8, 2013 9:10 AM by MadMacs0 RSS
  • Cowicide Moo Level 1 Level 1 (25 points)
    Currently Being Moderated
    Jun 6, 2013 12:56 PM (in response to MadMacs0)

    Well, I left "automatically install critical security updates" checked in my Security preferences and it didn't install the Mac OS 10.6.8 security update 2013-002 that came out yesterday.  It shows up in Software Update, but it's optional for me to install it manually.

     

    I really wish Apple would explain what the héll the option is and put it to rest.

     

    Why can't someone from Apple just finally come here and answer this simple question?

  • MadMacs0 Level 4 Level 4 (3,345 points)
    Currently Being Moderated
    Jun 6, 2013 1:14 PM (in response to Cowicide Moo)

    Cowicide Moo wrote:

     

    Why can't someone from Apple just finally come here and answer this simple question?

    Because they are not allowed to post as an Apple employee. This Forum is strictly user supported, so even if they do choose to post here it must be as a user and not an official Apple position.

  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Jun 6, 2013 5:41 PM (in response to MadMacs0)

    I think it's mainly because they love all the voodoo secrecy at Apple. Apple won't even say when they've stopped supporting an OS. Upper level techs don't even know. Remember I posted in this thread about contacting a "Senior Adviser" (a full blown idiot) by telephone who hadn't heard a word, and he wasn't faking it.

     

    Btw, there are now official Apple employees called Community Specialists posting to topics which have gone unanswered for a few days. But they are the last ones who would know anything about this. They just link to KB articles.

  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Jun 19, 2013 6:01 AM (in response to WZZZ)

    I have Little Snitch set to prompt for crsud and realized I hadn't been prompted in quite a while. I'm thinking the latest security update, the 2013-002, disabled crsud. The last entry I'm seeing for crsud in the install log is for 6/5, which was the date I installed that update.

     

    6/5 is also the latest XProtect update I'm seeing.

  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Jun 19, 2013 6:33 AM (in response to WZZZ)

    Not seeing where this would have been modified. Only this

     

    Screen shot 2013-06-19 at 9.21.28 AM.png

     

    Screen shot 2013-06-19 at 9.24.02 AM.png

     

    Maybe XProtect, which I think ran in tandem with crsud, was somehow modified?

  • andyBall_uk Level 6 Level 6 (17,705 points)
    Currently Being Moderated
    Jun 19, 2013 8:05 AM (in response to WZZZ)

    here at least, on 10.6.8  - crsud was disabled in

    /var/db/launchd.db/com.apple.launchd/overrides.plist

    during the startup after the update. Manually launching crsud detects that & gives "crsud service disabled - exiting now."

     

    if xprotect is detected as disabled, crsud disables itself (guessing, from strings) - which may be what happened.

  • MadMacs0 Level 4 Level 4 (3,345 points)
    Currently Being Moderated
    Jun 19, 2013 2:41 PM (in response to WZZZ)

    WZZZ wrote:

     

    I have Little Snitch set to prompt for crsud and realized I hadn't been prompted in quite a while. I'm thinking the latest security update, the 2013-002, disabled crsud. The last entry I'm seeing for crsud in the install log is for 6/5, which was the date I installed that update.

     

    6/5 is also the latest XProtect update I'm seeing.

    Very interesting.

     

    On the Mountain Lion front, I am still seeing these entries in the install.log on an irregular basis:

    Jun  1 00:59:14 Als-iMac-i7.local Software Update[56778]: SoftwareUpdate: Checking for critical updates only.

    Jun  1 06:00:33 Als-iMac-i7.local Software Update[57099]: SoftwareUpdate: Checking for critical updates only.

    Jun  1 09:38:37 Als-iMac-i7.local Software Update[57410]: SoftwareUpdate: Checking for critical updates only.

    Jun  1 12:59:15 Als-iMac-i7.local Software Update[61708]: SoftwareUpdate: Checking for critical updates only.

    Jun  1 17:41:23 Als-iMac-i7.local Software Update[6080]: SoftwareUpdate: Checking for critical updates only.

    Jun  1 18:42:01 Als-iMac-i7.local Software Update[6518]: SoftwareUpdate: Checking for critical updates only.

    Jun  1 21:41:23 Als-iMac-i7.local Software Update[7935]: SoftwareUpdate: Checking for critical updates only.

    Jun  1 22:42:01 Als-iMac-i7.local Software Update[8359]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 01:41:23 Als-iMac-i7.local Software Update[9747]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 05:29:56 Als-iMac-i7.local Software Update[10022]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 05:41:22 Als-iMac-i7.local Software Update[10203]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 07:40:11 Als-iMac-i7.local Software Update[10538]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 09:41:23 Als-iMac-i7.local Software Update[12965]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 11:33:57 Als-iMac-i7.local Software Update[15067]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 13:41:23 Als-iMac-i7.local Software Update[15955]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 14:42:01 Als-iMac-i7.local Software Update[18335]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 17:41:22 Als-iMac-i7.local Software Update[19511]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 18:42:01 Als-iMac-i7.local Software Update[19906]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 21:56:37 Als-iMac-i7.local Software Update[20830]: SoftwareUpdate: Checking for critical updates only.

    Jun  2 22:42:01 Als-iMac-i7.local Software Update[21204]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 01:41:22 Als-iMac-i7.local Software Update[22347]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 02:42:01 Als-iMac-i7.local Software Update[22710]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 07:40:12 Als-iMac-i7.local Software Update[22781]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 09:41:23 Als-iMac-i7.local Software Update[24572]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 10:42:02 Als-iMac-i7.local Software Update[27020]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 13:41:23 Als-iMac-i7.local Software Update[28377]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 14:42:37 Als-iMac-i7.local Software Update[28612]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 16:50:28 Als-iMac-i7.local Software Update[30544]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 17:41:22 Als-iMac-i7.local Software Update[30802]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 18:42:01 Als-iMac-i7.local Software Update[31173]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 20:59:58 Als-iMac-i7.local Software Update[32036]: SoftwareUpdate: Checking for critical updates only.

    Jun  3 21:41:22 Als-iMac-i7.local Software Update[32304]: SoftwareUpdate: Checking for critical updates only.

    Jun  4 23:50:43 Als-iMac-i7.local Software Update[11412]: SoftwareUpdate: Checking for critical updates only.

    Jun  5 04:45:21 Als-iMac-i7.local Software Update[13043]: SoftwareUpdate: Checking for critical updates only.

    Jun  5 07:50:43 Als-iMac-i7.local Software Update[14668]: SoftwareUpdate: Checking for critical updates only.

    Jun  9 18:51:35 Als-iMac-i7.local Software Update[15422]: SoftwareUpdate: Checking for critical updates only.

    Jun 10 18:51:36 Als-iMac-i7.local Software Update[28650]: SoftwareUpdate: Checking for critical updates only.

    Jun 10 22:51:35 Als-iMac-i7.local Software Update[30190]: SoftwareUpdate: Checking for critical updates only.

    Jun 11 02:51:35 Als-iMac-i7.local Software Update[31537]: SoftwareUpdate: Checking for critical updates only.

    Jun 11 06:51:34 Als-iMac-i7.local Software Update[32846]: SoftwareUpdate: Checking for critical updates only.

    Jun 12 10:51:36 Als-iMac-i7.local Software Update[65367]: SoftwareUpdate: Checking for critical updates only.

    Jun 12 14:51:35 Als-iMac-i7.local Software Update[66883]: SoftwareUpdate: Checking for critical updates only.

    Jun 12 18:51:35 Als-iMac-i7.local Software Update[71662]: SoftwareUpdate: Checking for critical updates only.

    Jun 12 22:51:35 Als-iMac-i7.local Software Update[72728]: SoftwareUpdate: Checking for critical updates only.

    Jun 13 02:51:35 Als-iMac-i7.local Software Update[74188]: SoftwareUpdate: Checking for critical updates only.

    Jun 13 06:51:34 Als-iMac-i7.local Software Update[75326]: SoftwareUpdate: Checking for critical updates only.

    Jun 13 10:51:34 Als-iMac-i7.local Software Update[90556]: SoftwareUpdate: Checking for critical updates only.

    Jun 13 14:51:35 Als-iMac-i7.local Software Update[95046]: SoftwareUpdate: Checking for critical updates only.

    Jun 13 18:51:35 Als-iMac-i7.local Software Update[2321]: SoftwareUpdate: Checking for critical updates only.

    Jun 13 22:51:36 Als-iMac-i7.local Software Update[3337]: SoftwareUpdate: Checking for critical updates only.

    Jun 14 02:51:35 Als-iMac-i7.local Software Update[4612]: SoftwareUpdate: Checking for critical updates only.

    Jun 14 07:40:18 Als-iMac-i7.local Software Update[5933]: SoftwareUpdate: Checking for critical updates only.

    Jun 14 11:38:00 Als-iMac-i7.local Software Update[10521]: SoftwareUpdate: Checking for critical updates only.

    Jun 15 11:45:25 Als-iMac-i7.local Software Update[24331]: SoftwareUpdate: Checking for critical updates only.

    Jun 15 16:56:32 Als-iMac-i7.local Software Update[26854]: SoftwareUpdate: Checking for critical updates only.

    As you can see there varying number of checks and large gaps with no checks at all (June 6-8 and 16-now). I'm sure some of it is due to computer sleep (set at one hour), but that doesn't come close to explaining all of it.

     

    I just double-checked and the latest XProtect update is still May 10, so you haven't missed anything there. I've gotten a check recorded every day around 09:24 local in every system.log for the last nine days.

  • powerbook1701 Level 3 Level 3 (545 points)
    Currently Being Moderated
    Jun 19, 2013 6:37 PM (in response to MadMacs0)

    For me, the last Xprotect I see is May 28th, version 64 on SL.

    Is someone seeing a newer version on SL than that?

  • MadMacs0 Level 4 Level 4 (3,345 points)
    Currently Being Moderated
    Jun 19, 2013 6:40 PM (in response to powerbook1701)

    powerbook1701 wrote:

     

    For me, the last Xprotect I see is May 28th, version 64 on SL.

    Is someone seeing a newer version on SL than that?

    No.

  • tingotanca Level 1 Level 1 (0 points)
    Currently Being Moderated
    Jun 20, 2013 2:35 AM (in response to powerbook1701)

    Last time I checked, that was on June 1st, mine was also v.64 on SL. But when I checked now, I had – hold it – v.21 dating back to some time in 2011. Not a clue why and when this might have happened. Running Safe Downlad Version set things straight again, but I am quite puzzled, to say the least.

  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Jun 20, 2013 6:53 AM (in response to andyBall_uk)

    andyBall_uk wrote:

     

    here at least, on 10.6.8  - crsud was disabled in

    /var/db/launchd.db/com.apple.launchd/overrides.plist

    during the startup after the update. Manually launching crsud detects that & gives "crsud service disabled - exiting now."

     

    if xprotect is detected as disabled, crsud disables itself (guessing, from strings) - which may be what happened.

    A couple of questions Andy.

     

    How were you able to manually launch crsud?

    When I try to run that using sudo /usr/libexec/crsud I just get a new window and

    /usr/libexec/crsud ; exit;

    logout

    [Process completed]

     

    I'm not getting "crsud service disabled - exiting now."

     

    And are you saying that the update may have disabled XProtect? How would we know if it has, and if it has any possible explanation for that? When I manually ran the XProtect updater yesterday, I just got Ignoring new signature plist: Not an increase in version.


  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Jun 20, 2013 7:13 AM (in response to WZZZ)

    OK, forget the last question about launching the executable. It was being launched. Looking in the install log I'm seeing several "crsud service disabled - exiting now" from when I did that.

     

    Still wondering about XProtect though.

     

    What has all this been about? This topic was weird when it started and it is getting weirder.

  • andyBall_uk Level 6 Level 6 (17,705 points)
    Currently Being Moderated
    Jun 20, 2013 8:14 AM (in response to WZZZ)

    >>And are you saying that the update may have disabled XProtect?

     

    No, still seems enabled via lauchagents & overrides - I was wondering if, when crusd ran, it (first time after the update) detected (rightly/wrongly & by design or not) that xprotect wasn't 'active' & told launchadd to add itself to overrides-disabled-true.

     

    Only because the change happened after booting, not as part of the install scripts, and anyway nothing obvious in the update to explain it.

  • WZZZ Level 6 Level 6 (11,900 points)
    Currently Being Moderated
    Jun 20, 2013 8:29 AM (in response to andyBall_uk)

    That's what I'm seeing for XProtect in overrides.

     

    Btw, in overrides, do you see com.apple.crsud disabled as false or true? Maybe it doesn't make any difference, but I just loaded it and not sure it should be after the update.

  • andyBall_uk Level 6 Level 6 (17,705 points)
    Currently Being Moderated
    Jun 20, 2013 8:39 AM (in response to WZZZ)

    I can't speak to should or shouldn't - just that :

     

    here at least, on 10.6.8  - crsud was disabled in

    /var/db/launchd.db/com.apple.launchd/overrides.plist

    during the startup after the update.

     

    So, disabled:true

Actions

More Like This

  • Retrieving data ...

Bookmarked By (1)

Legend

  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.