I've just recovered a Macbook (OS X 10.5.2, Leopard) which failed to boot because it got eternally stuck at a grey screen with an Apple logo and a spinning wheel.
The culprit was a corrupted configuration file (
/etc/authorization), and below I'll describe how I found and resolved the issue.
First, I checked whether the hardware was okay, by rebooting and pressing D to run hardware diagnostics. The hardware was fine, so I continued to look for error messages.
After booting in Verbose mode (Command (⌘) + V), I saw that securityd crashed, and that a crash log was written to
/Library/Logs/CrashReporter/securityd_2015-06-23-120634_localhost.crash. So once again I rebooted to get a shell in Single user mode (Command (⌘) + S). The log showed that the crash was caused by a call to
CFDictionaryContainsKey (which triggered an
EXC_BAD_ACCESS error). This fed my suspicion that the crash was caused by a bad configuration file.
I eventually came across this blog post, which suggests to use
fs_usage to monitor and log the file activity:
mount -uw /
fs_usage > /var/log/fs-usage.log &
After restarting, I looked in
/var/log/fs-usage.log and found that
private/etc/authorization before crashing. Then I viewed the content of
/etc/authorization, and it was indeed broken beyond repair.
To recover this file, I searched for the original version of the file in the source of the
securityd package (referenced at OS X 10.5.2's source code). I eventually found
etc/authorization.plist, which had some similarities with the corrupted
To complete the recovery, I put the new
etc/authorization.plist on a USB stick, plugged it into the Macbook (still in single user mode) and mounted the drive as follows:
mount -uw /
launchctl load /System/Library/LaunchDaemons/com.apple.kextd.plist
# Wait about 20 seconds
mount -t msdos -v -o ro /dev/disk1s1 /Volumes/usb
Then I copied the file to its destination, unmounted the USB stick, synced and rebooted successfully:
cp /Volumes/usb/authorization.plist /etc/authorization