Warning: “CSUserAgent wants to access data stored in your keychain.”

Question

For my backups I use an encrypted external hard disk. This hard disk has two partitions (names are: Backup, Private).

Today, when connecting the backup I was prompted with the following message:

• What does this mean?
• Why am I prompted by this after connecting the external disk?

About the hard disk

• The hard disk is encrypted using Disk Utility.app.
• Both volumes are Mac OS Extended (Journaled, Encrypted)
• In Disk Utility I can see that the volume Private has no owners enabled while Backup has owners enabled.

Background

Maybe the following info helps in answering the question of why I'm prompted with this now. The last time, that I've connected the hard disk, I've done the following:

• erase the Backup partition (which required a new password)

Answer 1

In a nutshell, CSUserAgent is part of the core Mac OS X system where the security is handled. In this case, it seems like an innocent warning and intended ask to make sure you are intending the encrypted backup to be used now.

You can verify this by opening up Keychain Access and looking at the item in your keychain. Here is a view of one of my portable hard drives that is encrypted with FileVault.

The Access Control tab will show you if any apps have been signed and trusted to access this item without further prompting - so unless you have some odd problem, your system is prompting you for the normal and usual tool that reads items from the keychain since you haven't white listed the task that normally does that job.

You can learn a little about the infrastructure from Apple at the Core Services Layer documentation as well as by using mdfind CSUserAgent from the terminal to locate where this program really lives on your mac. The keychain help and support articles are nice as well for reference.

Answer 2

I believe the CSUserAgent is related to Core Storage and the warning is asking you for permission to give that agent access to the password (or encryption key) for your backup drive.

It's difficult to be more specific because you don't tell us how your drives are encrypted, what software you're using to do the backups, how the drive was mounted, etc.

Assuming nothing nefarious is happening here (and, based on the limited information you provide, that would be my assumption) I would open Keychain Access, search for Encrypted Volume Password and make certain that CSUserAgent is listed as an application that always has access.