deny file-read-data /Library/Keychains/applepushserviced.keychain

Question

deny file-read-data /Library/Keychains/applepushserviced.keychain

Over the last few days my system has become less and less stable. I have had to reboot almost everyday and run disk utility to correct invalid file counts. I have used TechTool Pro and repaired and optimized the drive, but that has had little affect. I have recently noticed the following entries showing up repeatedly in my console:

3/3/11 8:38:37 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:39 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:40 PM sandboxd[245] awacsd(43) deny file-read-metadata /Library/Preferences/com.apple.security.plist
3/3/11 8:38:40 PM sandboxd[245] awacsd(43) deny file-read-data /Library/Preferences/com.apple.security.plist
3/3/11 8:38:40 PM sandboxd[245] awacsd(43) deny file-read-metadata /Library/Preferences/com.apple.security.plist
3/3/11 8:38:41 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:41 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:41 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:42 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:43 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:43 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:43 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:45 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:45 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain
3/3/11 8:38:45 PM sandboxd[245] mDNSResponder(20) deny file-read-data /Library/Keychains/applepushserviced.keychain

I've never seen these entries before and from a quick search of the web, it seems that no one else has either. Anyone out there with a little more experience than I have any ideas what I can look for or check to find out the source of the issue?

iMac 24" 3.06 GHz, MacMini 1.83GHz 4GB RAM; 15 PB G4 1.5GB; 1GHz G4 AGP 1.5GB, Mac OS X (10.6.6), AppleTV, Airport Extreme N Gig E, Time Capsule 1TB

Posted on Mar 3, 2011 11:56 AM

Reply

Answer 1

Best reply

baltwo

Level 9

62,362 points

Mar 3, 2011 1:55 PM in response to David Stempnakowski

Disable wifi and MobileMe stuff and see if that fixes things.

Reply

Answer 2

Mar 4, 2011 5:26 AM in response to baltwo

I am also seeing these same messages in my Logs.

I have also satisfied myself that they are connected with MobileMe (at least in my case). Disabling Wifi and MobileMe is not a solution it is simply a diagnostic step.

The question therefore remains, what is now causing these messages to occur? Have Apple made some changes to MobileMe which are causing them, I wonder?

And, most importantly, what - if anything - is now not working which was previously? I suspect it is MobileMe Syncronisation.

Reply

Answer 3

Mar 4, 2011 5:48 AM in response to Jon Richardson

Further to my previous posting, I have now established that the culprit would appear to be the new app "Facetime".

I can see that a new entry for "applepushserviced.keychain" was created at exactly the same time and date as I installed Facetime.

The question still remains, however - is this message in the log an error or something we can ignore? (i.e., what, if anything, is broken?)

Reply

Answer 4

Mar 4, 2011 6:45 AM in response to Jon Richardson

I seems that Apple forgot to change /usr/share/sandbox/mDNSResponder.sb to allow mDNSResponder access to the applepushserviced keychain. I modified mDNSResponder.sb and it appears to have fixed the problem. mDNSResponder.sb is just a text file but you need to be root to modify. I simply added:

(allow file-read-data (regex #"^/Library/Keychains/applepushserviced\.keychain$"))

after:

(allow file-read-data (regex #"^/Library/Keychains/System\.keychain$"))

Reply

Answer 5

Mar 4, 2011 9:59 AM in response to Eric Mockensturm

Yes, this makes sense as I have also installed Facetime. Interesting enough in my case is that the same time that this started happening I started having issues with TimeMachine backups to my Time Capsule. So, I made the same changes to the mDNSResponder.sb file and I will see if that resolves the issue, perhaps even both issues.

Reply

Answer 6

baltwo

Level 9

62,362 points

Mar 4, 2011 11:08 AM in response to Jon Richardson

I have also satisfied myself that they are connected with MobileMe (at least in my case). Disabling Wifi and MobileMe is not a solution it is simply a diagnostic step.

First step in troubleshooting, that's why I recommended it. As for the remaining question, others have jumped in with potential fixes.

Reply

Answer 7

baltwo

Level 9

62,362 points

Mar 4, 2011 11:09 AM in response to Eric Mockensturm

Nice find. I suggest that if you want to report this issue to Apple's engineering, then send a bug report or an enhancement request via its Bug Reporter system. To do this, join the Mac Developer Program—it's free and available for all Mac users and gets you a look at some development software. Since you already have an Apple username/ID, use that. Once a member, go to Apple BugReporter and file your bug report or enhancement request. The nice thing with this procedure is that you get a response and a follow-up number; thus, starting a dialog with engineering.

I don't muck with wifi, MobileMe, Time Machine, or Facetime, so can't help further.

Reply

Answer 8

Mar 5, 2011 8:20 AM in response to baltwo

I have more info on this resolution.

Turns out this all started happening with the release of FaceTime. Correct me if I'm wrong but I'm guessing there was some sort of inconsistency between the beta and the final release, and if you track back your log messages, you'll see they all start from the first time you used the new FaceTime (I was able to track it down to a time since I called someone). But the fix mentioned above did it for me.

Message was edited by: wfbnadador

Message was edited by: wfbnadador

Reply

Answer 9

davenik

Level 1

15 points

Mar 10, 2011 8:29 AM in response to David Stempnakowski

I used the technique described in this topic, and was able to rid my system of the mdnsresponder deny file-read-data messages completely.

However, I'm getting sandboxd awacsd deny file-read-metadata /Library/Preferences/com.apple.security.plist errors at a fairly steady rate in the console - about 100 a day.

e.g.

3/10/11 7:25:24 AM sandboxd[3384] awacsd(77) deny file-read-data /Library/Preferences/com.apple.security.plist
3/10/11 7:55:24 AM sandboxd[3519] awacsd(77) deny file-read-metadata /Library/Preferences/com.apple.security.plist
3/10/11 7:55:24 AM sandboxd[3519] awacsd(77) deny file-read-data /Library/Preferences/com.apple.security.plist
3/10/11 8:25:24 AM sandboxd[3606] awacsd(77) deny file-read-metadata /Library/Preferences/com.apple.security.plist

Is there something I should do to remove these? I believe they are related to Back-to-my-Mac, which I use (for screen sharing with the amazing iOS app, Screens).

Thanks,

Dave

Reply

Answer 10

Sailhome

Level 2

170 points

Mar 16, 2011 2:18 PM in response to Eric Mockensturm

After installing the FaceTime (non-beta) update on a MacBook running 10.6.6 these messages began to repeat

3/15/11 4:38:02 PM sandboxd[164] mDNSResponder(17) deny file-read-data /Library/Keychains/applepushserviced.keychain

I changed the /usr/share/sandbox/mDNSResponder.sb file per ericmock's post and the messages stopped.

Thanks for that!

And, for whatever reason, installing the FaceTime update on a Mac Pro did not produce the same problem.

Reply

Answer 11

Sailhome

Level 2

170 points

Mar 16, 2011 2:30 PM in response to davenik

Dave,

I had the same experience. The .keychain denial messages stopped, but

3/15/11 4:58:25 PM sandboxd[189] Notice awacsd(27) deny file-read-data /Library/Preferences/com.apple.security.plist

messages occurred. Taking a hint from the previous fix I changed

/usr/share/sandbox/awacsd.sb

to include

(literal "/Library/Preferences/com.apple.security.plist")

just after

(literal "/Library/Preferences/.GlobalPreferences.plist")

in the allow file-read section.

Well, that eliminated the intended message, but then a new one appeared after rebooting

3/15/11 5:17:09 PM sandboxd[194] Notice awacsd(27) deny file-read-data /Library/Keychains/applepushserviced.keychain

so I opened up the awacsd.sb file again and added this

(literal "/Library/Keychains/applepushserviced.keychain")

just after

(literal "/Library/Keychains/System.keychain")

and the new message went away.

Typically I don't 'adjust' system files. I'm on the watch for any potential side-effects of this maneuver. Will also be interesting to see if a future update by Apple brings any changes to the files in question.

Reply

Answer 12

davenik

Level 1

15 points

Mar 16, 2011 3:26 PM in response to Sailhome

Sailhome,

Thanks for posting this info - I'll do this, too. Let me know if you have any problems, I'll do likewise.

Best,

Dave

Reply

Answer 13

May 23, 2011 1:11 PM in response to Sailhome

FWIW, the same trick applied to krb5kdc trying to access /Library/Preferences/com.apple.security.plist did fix my MobileMe connection problem: the server was in the SHARED list but clicking on it resulted in Connection Failed.

Reply

Answer 14

Jun 27, 2011 4:48 PM in response to David Stempnakowski

It may be possible for average Joe users to simply reset Facetime by running the "Turn Facetime Off" (<command K> found under the Facetime menu inside the FaceTime app. Then "Turn FaceTime On" (same place).

For those like me without a camera for whom FaceTime wont work on my MacPro, (it does on my iPhone) I just leave it switched off.

My reasoning runs like this: computers whose users run Facetime need to contact the FaceTime servers to announce the users availability. My guess this is what the applespusherviced is attempting to do. Turning FaceTime off eliminates this need

(and may - I haven't checked this - modify the deamon's plist preventing future problems.

If ONLY APPLE provided knowledge base articles fully disclosing the cause and fix for common issues such as this. they used to once upon a time, then they adopted the "plant the users head in the sand and only the users bitten in the butt will notice" approach. This has great potential for causing larger problems. i.e., How does the user know that an answer labeled as "correct" has been properly vetted, and is approved by Apple?

(Or, am I missing something?)

Un-moderated user forums will spawn random hacks that may appear to fix problems but may cause further poorly documented problems - particularly with new features that Apple may deliver in succeeding updates. For instance I suspect that the trick suggested elsewhere in this discussion will break the iCloud service if one updates ones system to Lion without a clean install.

Reply

Answer 15

Jul 28, 2011 6:08 AM in response to David Stempnakowski

i had exactly the same issues. repairing the keychain solved everything for me.

i also wrote a blog entry for people having the same issue.

see the post here: http://www.nanofunk.net/excessive-logging-on-mac-osx-10-7-lion-repair-the-keycha in-to-solve-the-issues-deny-file-read-data/

Reply