crsud process with security update 2013-001

Cowicide Moo wrote:

Why can't someone from Apple just finally come here and answer this simple question?

Because they are not allowed to post as an Apple employee. This Forum is strictly user supported, so even if they do choose to post here it must be as a user and not an official Apple position.

I think it's mainly because they love all the voodoo secrecy at Apple. Apple won't even say when they've stopped supporting an OS. Upper level techs don't even know. Remember I posted in this thread about contacting a "Senior Adviser" (a full blown idiot) by telephone who hadn't heard a word, and he wasn't faking it.

Btw, there are now official Apple employees called Community Specialists posting to topics which have gone unanswered for a few days. But they are the last ones who would know anything about this. They just link to KB articles.

I have Little Snitch set to prompt for crsud and realized I hadn't been prompted in quite a while. I'm thinking the latest security update, the 2013-002, disabled crsud. The last entry I'm seeing for crsud in the install log is for 6/5, which was the date I installed that update.

6/5 is also the latest XProtect update I'm seeing.

Not seeing where this would have been modified. Only this

Maybe XProtect, which I think ran in tandem with crsud, was somehow modified?

here at least, on 10.6.8 - crsud was disabled in

/var/db/launchd.db/com.apple.launchd/overrides.plist

during the startup after the update. Manually launching crsud detects that & gives "crsud service disabled - exiting now."

if xprotect is detected as disabled, crsud disables itself (guessing, from strings) - which may be what happened.

WZZZ wrote:

I have Little Snitch set to prompt for crsud and realized I hadn't been prompted in quite a while. I'm thinking the latest security update, the 2013-002, disabled crsud. The last entry I'm seeing for crsud in the install log is for 6/5, which was the date I installed that update.

6/5 is also the latest XProtect update I'm seeing.

Very interesting.

On the Mountain Lion front, I am still seeing these entries in the install.log on an irregular basis:

Jun 1 00:59:14 Als-iMac-i7.local Software Update[56778]: SoftwareUpdate: Checking for critical updates only.

Jun 1 06:00:33 Als-iMac-i7.local Software Update[57099]: SoftwareUpdate: Checking for critical updates only.

Jun 1 09:38:37 Als-iMac-i7.local Software Update[57410]: SoftwareUpdate: Checking for critical updates only.

Jun 1 12:59:15 Als-iMac-i7.local Software Update[61708]: SoftwareUpdate: Checking for critical updates only.

Jun 1 17:41:23 Als-iMac-i7.local Software Update[6080]: SoftwareUpdate: Checking for critical updates only.

Jun 1 18:42:01 Als-iMac-i7.local Software Update[6518]: SoftwareUpdate: Checking for critical updates only.

Jun 1 21:41:23 Als-iMac-i7.local Software Update[7935]: SoftwareUpdate: Checking for critical updates only.

Jun 1 22:42:01 Als-iMac-i7.local Software Update[8359]: SoftwareUpdate: Checking for critical updates only.

Jun 2 01:41:23 Als-iMac-i7.local Software Update[9747]: SoftwareUpdate: Checking for critical updates only.

Jun 2 05:29:56 Als-iMac-i7.local Software Update[10022]: SoftwareUpdate: Checking for critical updates only.

Jun 2 05:41:22 Als-iMac-i7.local Software Update[10203]: SoftwareUpdate: Checking for critical updates only.

Jun 2 07:40:11 Als-iMac-i7.local Software Update[10538]: SoftwareUpdate: Checking for critical updates only.

Jun 2 09:41:23 Als-iMac-i7.local Software Update[12965]: SoftwareUpdate: Checking for critical updates only.

Jun 2 11:33:57 Als-iMac-i7.local Software Update[15067]: SoftwareUpdate: Checking for critical updates only.

Jun 2 13:41:23 Als-iMac-i7.local Software Update[15955]: SoftwareUpdate: Checking for critical updates only.

Jun 2 14:42:01 Als-iMac-i7.local Software Update[18335]: SoftwareUpdate: Checking for critical updates only.

Jun 2 17:41:22 Als-iMac-i7.local Software Update[19511]: SoftwareUpdate: Checking for critical updates only.

Jun 2 18:42:01 Als-iMac-i7.local Software Update[19906]: SoftwareUpdate: Checking for critical updates only.

Jun 2 21:56:37 Als-iMac-i7.local Software Update[20830]: SoftwareUpdate: Checking for critical updates only.

Jun 2 22:42:01 Als-iMac-i7.local Software Update[21204]: SoftwareUpdate: Checking for critical updates only.

Jun 3 01:41:22 Als-iMac-i7.local Software Update[22347]: SoftwareUpdate: Checking for critical updates only.

Jun 3 02:42:01 Als-iMac-i7.local Software Update[22710]: SoftwareUpdate: Checking for critical updates only.

Jun 3 07:40:12 Als-iMac-i7.local Software Update[22781]: SoftwareUpdate: Checking for critical updates only.

Jun 3 09:41:23 Als-iMac-i7.local Software Update[24572]: SoftwareUpdate: Checking for critical updates only.

Jun 3 10:42:02 Als-iMac-i7.local Software Update[27020]: SoftwareUpdate: Checking for critical updates only.

Jun 3 13:41:23 Als-iMac-i7.local Software Update[28377]: SoftwareUpdate: Checking for critical updates only.

Jun 3 14:42:37 Als-iMac-i7.local Software Update[28612]: SoftwareUpdate: Checking for critical updates only.

Jun 3 16:50:28 Als-iMac-i7.local Software Update[30544]: SoftwareUpdate: Checking for critical updates only.

Jun 3 17:41:22 Als-iMac-i7.local Software Update[30802]: SoftwareUpdate: Checking for critical updates only.

Jun 3 18:42:01 Als-iMac-i7.local Software Update[31173]: SoftwareUpdate: Checking for critical updates only.

Jun 3 20:59:58 Als-iMac-i7.local Software Update[32036]: SoftwareUpdate: Checking for critical updates only.

Jun 3 21:41:22 Als-iMac-i7.local Software Update[32304]: SoftwareUpdate: Checking for critical updates only.

Jun 4 23:50:43 Als-iMac-i7.local Software Update[11412]: SoftwareUpdate: Checking for critical updates only.

Jun 5 04:45:21 Als-iMac-i7.local Software Update[13043]: SoftwareUpdate: Checking for critical updates only.

Jun 5 07:50:43 Als-iMac-i7.local Software Update[14668]: SoftwareUpdate: Checking for critical updates only.

Jun 9 18:51:35 Als-iMac-i7.local Software Update[15422]: SoftwareUpdate: Checking for critical updates only.

Jun 10 18:51:36 Als-iMac-i7.local Software Update[28650]: SoftwareUpdate: Checking for critical updates only.

Jun 10 22:51:35 Als-iMac-i7.local Software Update[30190]: SoftwareUpdate: Checking for critical updates only.

Jun 11 02:51:35 Als-iMac-i7.local Software Update[31537]: SoftwareUpdate: Checking for critical updates only.

Jun 11 06:51:34 Als-iMac-i7.local Software Update[32846]: SoftwareUpdate: Checking for critical updates only.

Jun 12 10:51:36 Als-iMac-i7.local Software Update[65367]: SoftwareUpdate: Checking for critical updates only.

Jun 12 14:51:35 Als-iMac-i7.local Software Update[66883]: SoftwareUpdate: Checking for critical updates only.

Jun 12 18:51:35 Als-iMac-i7.local Software Update[71662]: SoftwareUpdate: Checking for critical updates only.

Jun 12 22:51:35 Als-iMac-i7.local Software Update[72728]: SoftwareUpdate: Checking for critical updates only.

Jun 13 02:51:35 Als-iMac-i7.local Software Update[74188]: SoftwareUpdate: Checking for critical updates only.

Jun 13 06:51:34 Als-iMac-i7.local Software Update[75326]: SoftwareUpdate: Checking for critical updates only.

Jun 13 10:51:34 Als-iMac-i7.local Software Update[90556]: SoftwareUpdate: Checking for critical updates only.

Jun 13 14:51:35 Als-iMac-i7.local Software Update[95046]: SoftwareUpdate: Checking for critical updates only.

Jun 13 18:51:35 Als-iMac-i7.local Software Update[2321]: SoftwareUpdate: Checking for critical updates only.

Jun 13 22:51:36 Als-iMac-i7.local Software Update[3337]: SoftwareUpdate: Checking for critical updates only.

Jun 14 02:51:35 Als-iMac-i7.local Software Update[4612]: SoftwareUpdate: Checking for critical updates only.

Jun 14 07:40:18 Als-iMac-i7.local Software Update[5933]: SoftwareUpdate: Checking for critical updates only.

Jun 14 11:38:00 Als-iMac-i7.local Software Update[10521]: SoftwareUpdate: Checking for critical updates only.

Jun 15 11:45:25 Als-iMac-i7.local Software Update[24331]: SoftwareUpdate: Checking for critical updates only.

Jun 15 16:56:32 Als-iMac-i7.local Software Update[26854]: SoftwareUpdate: Checking for critical updates only.

As you can see there varying number of checks and large gaps with no checks at all (June 6-8 and 16-now). I'm sure some of it is due to computer sleep (set at one hour), but that doesn't come close to explaining all of it.

I just double-checked and the latest XProtect update is still May 10, so you haven't missed anything there. I've gotten a check recorded every day around 09:24 local in every system.log for the last nine days.

For me, the last Xprotect I see is May 28th, version 64 on SL.

Is someone seeing a newer version on SL than that?

powerbook1701 wrote:

For me, the last Xprotect I see is May 28th, version 64 on SL.

Is someone seeing a newer version on SL than that?

No.

Last time I checked, that was on June 1st, mine was also v.64 on SL. But when I checked now, I had – hold it – v.21 dating back to some time in 2011. Not a clue why and when this might have happened. Running Safe Downlad Version set things straight again, but I am quite puzzled, to say the least.

andyBall_uk wrote:

here at least, on 10.6.8 - crsud was disabled in

/var/db/launchd.db/com.apple.launchd/overrides.plist

during the startup after the update. Manually launching crsud detects that & gives "crsud service disabled - exiting now."

if xprotect is detected as disabled, crsud disables itself (guessing, from strings) - which may be what happened.

A couple of questions Andy.

How were you able to manually launch crsud?

When I try to run that using sudo /usr/libexec/crsud I just get a new window and

/usr/libexec/crsud ; exit;

logout

[Process completed]

I'm not getting "crsud service disabled - exiting now."

And are you saying that the update may have disabled XProtect? How would we know if it has, and if it has any possible explanation for that? When I manually ran the XProtect updater yesterday, I just got Ignoring new signature plist: Not an increase in version.

OK, forget the last question about launching the executable. It was being launched. Looking in the install log I'm seeing several "crsud service disabled - exiting now" from when I did that.

Still wondering about XProtect though.

What has all this been about? This topic was weird when it started and it is getting weirder.

>>And are you saying that the update may have disabled XProtect?

No, still seems enabled via lauchagents & overrides - I was wondering if, when crusd ran, it (first time after the update) detected (rightly/wrongly & by design or not) that xprotect wasn't 'active' & told launchadd to add itself to overrides-disabled-true.

Only because the change happened after booting, not as part of the install scripts, and anyway nothing obvious in the update to explain it.

That's what I'm seeing for XProtect in overrides.

Btw, in overrides, do you see com.apple.crsud disabled as false or true? Maybe it doesn't make any difference, but I just loaded it and not sure it should be after the update.

I can't speak to should or shouldn't - just that :

here at least, on 10.6.8 - crsud was disabled in

/var/db/launchd.db/com.apple.launchd/overrides.plist

during the startup after the update.

So, disabled:true

That's right you already had written that. OK disabled it will be, for better or worse.