sandboxd messages in console related to mdworker

I have the same problem, but it also prevents my MBA 2010 from sleep!

Unfortunatelly, I dont understand half of your post and I dont have an answer 😟

somebody please help us!

Have you got the hidden User Library in 'Favorites' in Finder's sidebar, by any chance, or have you used the chflags command to make that library unhidden?

nope and nope. I use option key+ click on GO in finder when i need to access the Library folder..

I've also seen that my login.keychain file has a com.apple.quarantine flag on it when I perform an ls -lae@ listing of ~/Library/Keychains/ in terminal.

I also have the extended attr. but no problems with sandboxing and Console messages.

There may be a more elegant solution than this, but let me tell you what worked for me.

That sandbox message tells us that Spotlight is trying to search your ~/Library folder, but since Spotlight doesn't have permission to do so, sandbox prevents it from succeeding. Sandbox stops Spotlight from succeeding, but it doesn't stop it from trying. Hence, you see the repeated messages and mds worker keeps plugging away.

The way I stopped it was to make that folder visible by using this command in Terminal:

chflags nohidden ~/Library

Then, open System Preferences > Spotlight | Privacy

Open a Finder window and navigate to ~/Library. Drag it into the Privacy pane.

Go back to Terminal and do

chflags hidden ~/Library

Technically, if the folder is hidden with chflags Spotlight should ignore it automatically, but clearly for some of us this isn't working. Maybe its a bug in ML, I don't know, but the above solution worked in my case. Give it a try and report back.

Adding the Library folder to the Spotlight privacy pane didn't work for me. Still getting the repeated messages in the Console.

Yes, unfortunately I found these messages again about 24hours later.

Back to the drawing board on this one, I'm afraid. 😢

What's strange is I'm seeing far fewer of these now than I was before. A couple then none for 2hrs or so, then a couple more, and then none... and so on.

That's vastly different from a few days ago, when this seemed to be polling almost all the time.

In any case, there is another solution that I can think of, but not one I've implemented myself because I use Spotlight so much, but that is to simply turn Spotlight off. If Spotlight's not important to you or you want to have a go, open Terminal.app and paste this command into the Terminal window:

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.metadata.mds.plist

Press 'return' and enter you admin password (it will not echo to the screen, so type carefully.

To undo this command and re-enable Spotlight, use

sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.metadata.mds.plist

excluding the Library folder, or the Keychain folder did not work for me either.. After that I also cleared caches, rebuilt Spotlight index and restarted the machine.. and nothing changed.

there is a pattern- every 3 or 4 minutes i get first sandboxd message:

Aug 7 19:43:14 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-g0C3Wp

then always followed by:

Aug 7 19:43:14 xxx kernel[0]: Sandbox: sandboxd(7516) deny mach-lookup com.apple.coresymbolicationd

and ending with 11 same messages:

Aug 7 19:43:14 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-RBT6gE

Aug 7 19:43:14 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-ri0Qb6

Aug 7 19:43:14 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-N3FgDJ

Aug 7 19:43:14 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-nAPG8V

Aug 7 19:43:14 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-1I6eIF

Aug 7 19:43:15 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-MO6UcN

Aug 7 19:43:15 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-pWMKSb

Aug 7 19:43:15 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-oWhURV

Aug 7 19:43:15 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-A9TVRN

Aug 7 19:43:15 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-gHL7v9

Aug 7 19:43:15 xxx sandboxd[7516] ([7515]): mdworker(7515) deny file-write-create /Users/swerty/Library/Keychains/login.keychain.sb-dc6a0053-b5zZgU

(xxx is our domain edited out)

followed by several "bootpd[4636]: service time 0.000006 seconds " messages.

I really dont want to disable Spotlight:/

This issue seems to have cleared up for me in yesterday's update to 10.8.1. Those repeated console messages are gone.

Yep, I've just checked, all gone! perfect!:)