sandboxd: ([522]) PluginProcess(522) deny file-read-data /Library/ScriptingAdditions

I have narrowed this down to the Flash Player plug. It seems to be most common on YouTube, causing pauses in the video every few seconds because of high CPU use by sandboxd. IP logs show Google addresses attempting connection at the same time this is happening.

How to cure it? Not sure. I have tried blocking access to the IPs, but they just use other IPs.

I was seeing the same problem (MacOS 10.7.5, Flash 11,9,900,152 - though I think I've been hitting it for a while. I have what appears to be a fix, though I'll warn you that it requires hand editing of a configuration file that I believe you're officially not supposed to touch. If you follow the instructions as I give them, I think the worst you can do is break Safari - and likely just Flash in Safari, and you'll be able to recover quickly by just putting back a saved file. But ... this is not a very "Mac friendly" procedure.

The details: The configuration file that controls what the Flash player is allowed to access from the sandbox is:

/System/Library/StagedFrameworks/Safari/WebKit2.framework/Versions/A/Resources/P lugInSandboxProfiles/com.macromedia.Flash Player.plugin.sb

You need to edit this as a simple text file. I used Emacs. You can probably use Textedit, but make sure the result is just a simple text file, not, for example, a Rich Text file. Make sure to create a backup of the original file first. The steps I followed - in a terminal window, cd'ed into the PluginSandboxProfiles directory - were:

1. sudo cp com.macromedia.Flash Player.plugin.sb com.macromedia.Flash Player.plugin.sb-save

(Enter your password when prompted.)

This makes a safe copy. You need sudo to have permission to write in the PluginSandboxProfiles directory,

2. cp com.macromedia.Flash Player.plugin.sb ~

Make a copy in your home directory. You can edit that copy without having to use an editor under sudo, which is safer.

3. Open the copy of com.macromedia.Flash Player.plugin.sb in your home directory in whatever editor you will be using. It's a fairly small file. Search for a line that reads:

(allow file-read*

There's more than one of these, and there are others that start this way but also list other permissions, One of the ones that has just "file-read*" is followed by a line reading:

(literal "/Library/PreferencePanes/Flash Player.prefPane")

Just before that line, insert the following two lines:

(subpath "/Library/ScriptingAdditions")

(home-library-literal "/ScriptingAdditions")

4. Save the file (to your local directory).

5. Execute:

sudo cp ~/com.macromedia.Flash Player.plugin.sb .

(You'll need to be in that PluginSandboxProfiles directory again. Depending on how long it's been since you previously typed your password to sudo, you may have to do it again.)

And ... that should be it. I found that the sandboxd process would time out and exit, and then restart, reading the modified file. But just to be sure you can restart Safari. Performance should now be much better.

Good luck.

-- Jerry

I can handle that. I've been scripting in BBEdit for over a decade. Actually, I have a backup system on an external firewire that I refreshed a week ago. I can grab a copy easily to dupe and edit, and keep my backup handy. I can do the swap booted from the external. The Finder gives me comfort..... nothing against Terminal, but I keep its use to a minimum. Typos can be deadly.

Thanks. I appreciate it.

Didn't work. It froze up the YouTube page (beachball), and I couldn't initiate any videos.

Logs showed a problem determining pathway for the scripting additions folders.

It worked fine on all other websites and the rest of Google.

I might give it a try with hard pathways and see if that works.

Odd. It's been working for me - including on YouTube. Could you post the exact error message you get?

I ended up clearing the log and don't have any Console messages from the event. The YouTube portal page would load partially, about half of the preview images would appear, and then freeze, and the spinning beachball would appear. I had to force quit Safari.

I ended up switching over to unsafe mode for YouTube and the sites where I often watch YouTube embedded. I don't feel threatened by YouTube Flash encoding/player.

Now I get many repetitions of the error: sandboxd: ([2081]) PluginProcess(2081) deny file-read-data /Library/ScriptingAdditions

Same for User/ folder too. It's one of the reasons I cleared the log, it gets bloated with these when I use unsafe mode.

If I find the time, I'll see if I can recreate the event. Right now, I'm tied up with a long render time in a 3D studio, doing complex transparent liquids. It will be tomorrow before it frees up and I feel comfortable going into the system.

I've been playing around with this, and there's more to it than meets the eye. I have several Mac's, all running the same release and patch configuration of MacOS and Safari and such. Only one has so far exhibited this behavior. Clearly something is different in its setup, but I have no idea what.

As you've found, these log messages are associated with severe delays and really bad performance. If everyone were seeing them, there would be a ton of complaints (and Apple would have fixed it by now). But it seems only an unlucky few of us get hit by this. It would be nice to track down and eliminate the root cause, but at the moment I have no idea what to look at.

-- Jerry

Here is the link to the thread that I posted initially, showing the Console message.

https://discussions.apple.com/thread/5581123

It's not YouTube, as I have found a number of other Flash video player sites that exhibit the same problem. I noted it has the same problem with JWplayer, which is a lot easier to analyse. I can tell it has to do with Flash Player plug, Safari 6.1, and the safe/unsafe protocol that Adobe placed in Flash. I'm able to remove the pauses by using unsafe mode. If I doubt the intent of the website, I use Firefox to watch the stream.

My gut feeling is that Adobe created the safe browsing system to cover Flash's vulnerabilities and didn't spend a whole lot of time on older copies of Safari. So I would look at Safari and see where it raises flags that kick in sandboxd. I'm not sure if I can get a debugging version of Safari in AD, but I'll check.