Unexpected Quarantine set on keychains

Question

In my Console logs I've been noticing these two messages repeated constantly:

4/7/16 5:06:17.726 PM Safari[383]: KeychainGetICDPStatus: keychain: -25300
4/7/16 5:06:17.726 PM Safari[383]: KeychainGetICDPStatus: status: off

I ran the security tool against the error code:

[kb:Forsaken:0:~ ]$  security error -25300
Error: 0xFFFF9D2C -25300 The specified item could not be found in the keychain.

I don't actually know what Safari is looking for, but apparently it is lost. After a while, I checked the actual keychain file. To my suprise it was quarantined.

xattr -l ~/Library/Keychains/login.keychain
com.apple.quarantine: 0001;570253b9;Safari.app;

If I'm reading this right, Safari has set the quarantine attribute on my keychain.

Checking the system directory, I see that my System.keychain is fine, but the apsd.keychain has been quarantined.

xattr -l /Library/Keychains/apsd.keychain 
com.apple.quarantine: 0006;56fbb5f8;com.apple.apsd;

Why is this happening? I'm not downloading these files. I don't know how to find out what Safari is looking for. My logs are full of messages, but oddly, other apps don't seem to be having a problem accessing the keychain.

Stumped.

EDIT:

I did, in fact, go insane tracking this down. Found out about this "feature" far too late: http://openradar.appspot.com/25618668 . FYI: if you run "locate diagnose" you'll find inside the app bundles tools that might help in the future for someone. What I ended up doing was just signing out of icloud with my standard user. I sync the passwords in Safari every now and then. Apple makes good hardware. I've loved it for years. /me sighs.

Answer 1

I suggest going to https://developer.apple.com/support/certificates/ and do a bit of research on certificates. Certs are used to verify the identity of whoever made a program, or owns a website (for encrypted connections).

At that link you can also find the Apple-supplied root certs you can add to your keychain if you're missing any specific certificate, or have a malicious one. Certs are stored in your keychains.

* Be sure to keep an eye for a lock or green text in the safari address bar to indicate an encrypted connection! That page will be a target for middle-men! *

The beginning of this year was chaos for certificates. With OS X 10.11 and many many certs expiring, waiting for renew, many hackers took advantage. You may have picked something up, as I know I have and still have it. I have the same issue as you.

Easiest solution (maybe) is to reinstall. Back up your data, but do NOT use it to restore your account after the reinstall.

Let me know if you need more information.

Also, unless you're actually experiencing problems, stay away from the console. It'll drive you into insanity. The messages are never pleasent. Here are some of mine for example of what (According to apple tier 3 engineers) is normal behavior. If your accounts are having issues, then I would worry about it.

4/7/16 20:59:33.000 kernel[0]: decmpfs.c:579:decmpfs_fast_file_is_compressed: decmpfs_fast_get_state called on unknown file

Apr 3 17:12:06 jahheins-MacBook-Pro kernel[0] : Sandbox: SpotlightNetHelp(302) deny(1) file-read-data /Applications/Safari.app ---- This is a common one. Its due to SIP (System Integrity Protection) Apple seems to be too dumb to tell their programs to stop accessing any program files to a program they've designed to be off-limits.

I also have a lot of kernel crashes. Faulty boot ups, and GPU Issues. Logic board, bat, screen, trackpad, and keyboard were all just replaced and my board is having issues swapping GPUs in the Retina.

Regarding why it was quarantined: Between OS X 10.10 to 10.11 and the SIP changes, any SIP programs or files that are found to be not acting the "rootless" way are instantly quarantined. Usually migration helper is in one of the files and may be the culprit. I've had my airport do the same thing, and ASPD (The key to rootless).