crsud process with security update 2013-001

I use EasyFind. All I have for crsud is

/System/Library/LaunchDaemons/com.apple.crsud.plist

/usr/libexec/crsud

/private/var/db/install/crsud.plist

If I use Go to folder for /private/var/root/Library/Caches/crsud I get folder not found. If I enter just /private/var/root I don't have permission to see its contents.

If I enter sudo open /private/var/root/Library/Caches/crsud nothing happens.

But even if I just enter sudo open /private/var/root/ I get a Preview root folder showing with no access. I would have thought sudo open would blow away all ACLs. I guess it doesn't.

I'm going to try to set up EF with root privileges.

use sudo ls,or cat/less if you want to see the cache.db content

FaF makes it very easy, I use both that & EF

even Devon suggest it " Alternative: Feel free to have a look at Thomas Tempelmann's Find Any File. In contrast to EasyFind you'll get a hierarchical result list, you can search as "root" user, search after date ranges and file sizes, and save searches and re-run them later." although I'd expect that EF can be usefully run via sudo, like disk usage apps.

Thanks for the suggestions. I have FAF, just never use it or got used to it.

Anyway, with EF with admin priviliges, I can search root. I still can't open that folder from there, but it's there alright.

I'm seeing it was modified yesterday also.

Will have a look with FAF too.

Tried FAF with root. No dice. I don't need a full FAF tutorial--I can find that elsewhere--but you might want to suggest what I'm doing wrong here. Tried almost all the different choices in the dropdown from "contains phrase") Thanks.

I used name contains:crsud

no other choices

That did the trick. Thanks.

Btw, never bothered with FAF before. I set up a script to run EF as root, but now that I know that FAF can easily be set to search root, that will be even easier and very useful at times.Thanks again for the tip.

Lion has System Preferences > Security & Privacy > Advanced > Automatically install important security updates.

The clues would imply that crsud runs every 4 hours to check for the important security updates.

My guess is the name stands for CRitical Security Update Daemon.

Michael Schmitt wrote:

The clues would imply that crsud runs every 4 hours to check for the important security updates.

I have Little Snitch asking for crsud, it seems to go by the time and date as if it didn't run it will try during log-in time, but not all the time, else it asks about once day or so, I think it's like every 26 hours or so.

This is 10.6.8, might be more often on the Lions.

It's scheduled to run every 4 hours in Snow Leopard, but Snow Leopard only counts awake time.

Michael Schmitt wrote:

It's scheduled to run every 4 hours in Snow Leopard, but Snow Leopard only counts awake time.

It might be running every four hours, but it's checking for updates every 20 something hours unless it missed it, then it will check for updates upon login time.

If it checked for updates every four hours, it would have bugged the crap out me as I watch all my network connections.

Michael Schmitt wrote:

The clues would imply that crsud runs every 4 hours to check for the important security updates.

We can settle this really quick if somebody will post the contents of /System/Library/LaunchDaemons/com.apple.crsud.plist

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>StartInterval</key>

<integer>14400</integer>

<key>RunAtLoad</key>

<true/>

<key>Label</key>

<string>com.apple.crsud</string>

<key>OnDemand</key>

<true/>

<key>Program</key>

<string>/usr/libexec/crsud</string>

<key>UserName</key>

<string>root</string>

</dict>

</plist>

Must be every four hours of actual running time. I've since allowed it in Little Snitch to run behind the scenes. But before I did, I'm pretty sure I wasn't being prompted to allow every four hours, even of running time.

I'd still love to see this thing bring over an actual update. Would that go to XProtect or what? Since XProtect is already set to bring things over on a regular basis, I'm still puzzled what this thing actually does. Hard to imagine it silently installing a security update, since those have always required a restart. No one seems to have figured this out; all the hits I get for crsud are from around 3/15, when this thing first appeared.

Message was edited by: WZZZ

I'm possibly the least qualified person to be commenting on this having leapfrogged from Leopard on PPC to Mountain Lion on an i7, so I can't check anything to do with Lion or SL. It is clear, though, that different OS's are handling it with slight differences.

My XProtect option is here

as it apparently is for Lion. The Help Center goes on to say:

But the "Automatically install important updates" for me has been moved to Software Update and reworded as "Install system data files and security updates"

and the Help Center says:

WZZZ wrote:

Must be every four hours of actual running time.

Did I read earlier that SL handles "StartInterval" differently than Lion & ML?

Would that go to XProtect or what? Since XProtect is already set to bring things over on a regular basis, I'm still puzzled what this thing actually does. Hard to imagine it silently installing a security update, since those have always required a restart. No one seems to have figured this out; all the hits I get for crsud are from around 3/15, when this thing first appeared.

I doubt that it's at all connected with XProtect, for as you say that's already on a 24-hour basis and is apparently always on now for SL users. In order to test it you would have to have the crsud option disabled and wait for the next XProtect update to know for certain. If it didn't happen within 24 hours (clock time or run time?), then you would need to try toggling it to see if they are connected.

In Lion and ML it's obviously controlled by different processes.

Start interval is daily:

cat /System/Library/LaunchDaemons/com.apple.xprotectupdater.plist

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>StartInterval</key>

<integer>86400</integer>

<key>Label</key>

<string>com.apple.xprotectupdater</string>

<key>ProgramArguments</key>

<array>

<string>/usr/libexec/XProtectUpdater</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>