I've just recovered a Macbook (OS X 10.5.2, Leopard) which failed to boot because it got eternally stuck at a grey screen with an Apple logo and a spinning wheel.
The culprit was a corrupted configuration file (/etc/authorization
), and below I'll describe how I found and resolved the issue.
First, I checked whether the hardware was okay, by rebooting and pressing D to run hardware diagnostics. The hardware was fine, so I continued to look for error messages.
After booting in Verbose mode (Command (⌘) + V), I saw that securityd crashed, and that a crash log was written to /Library/Logs/CrashReporter/securityd_2015-06-23-120634_localhost.crash
. So once again I rebooted to get a shell in Single user mode (Command (⌘) + S). The log showed that the crash was caused by a call to CFDictionaryContainsKey
(which triggered an EXC_BAD_ACCESS
error). This fed my suspicion that the crash was caused by a bad configuration file.
I eventually came across this blog post, which suggests to use fs_usage
to monitor and log the file activity:
mount -uw /
fs_usage > /var/log/fs-usage.log &
exit
After restarting, I looked in /var/log/fs-usage.log
and found that securityd
accessed private/etc/authorization
before crashing. Then I viewed the content of /etc/authorization
, and it was indeed broken beyond repair.
To recover this file, I searched for the original version of the file in the source of the securityd
package (referenced at OS X 10.5.2's source code). I eventually found etc/authorization.plist
, which had some similarities with the corrupted /etc/authorization
.
To complete the recovery, I put the new etc/authorization.plist
on a USB stick, plugged it into the Macbook (still in single user mode) and mounted the drive as follows:
mount -uw /
launchctl load /System/Library/LaunchDaemons/com.apple.kextd.plist
# Wait about 20 seconds
mkdir /Volumes/usb
mount -t msdos -v -o ro /dev/disk1s1 /Volumes/usb
Then I copied the file to its destination, unmounted the USB stick, synced and rebooted successfully:
cp /Volumes/usb/authorization.plist /etc/authorization
umount /Volumes/usb
sync
reboot