10

Since installing OSX 10.10 (Yosemite), my console is full of error messages regarding fmfd, like fmfd(384) deny file-read-metadata /Volumes/Macintosh HD

This happens mostly at startup and when starting programs. I just want to know what it is, for my peace of mind and that my console can lose some weight ;)

Here´s some more (hopefully useful) information from one report:

fmfd(384) deny file-read-metadata /Volumes/Macintosh HD

Process:         fmfd [384]
Path:            /usr/libexec/fmfd
Load Address:    0x105f38000
Identifier:      fmfd
Version:         ??? (???)
Code Type:       x86_64 (Native)
Parent Process:  launchd [1]

Date/Time:       2014-10-21 17:13:10.336 +0200
OS Version:      Mac OS X 10.10 (14A389)
Report Version:  8

Can you help me with that, or assure me it´s harmless? I don´t necessarily want to allow the process more rights in the sandbox if not necessary, like they did in https://discussions.apple.com/thread/5495141?start=15&tstart=0

Improve this question
6
  • I'm also having this in Console. I've found that I can stop this issue by loading Terminal and doing sudo kill 384 (or whatever PID is coming up in Console). It will go away for a period (mine went away for approximately 2 hours), but it eventually recurs, so this is a temporary fix.
    – John Coxon
    Commented Oct 21, 2014 at 19:46
  • Thank you, but just killing the process should not be the solution. Do you know what fmfd stands for?
    – TAKeanice
    Commented Oct 22, 2014 at 10:18
  • Nope; the above is all the information I have, and investigating /System/Library/LaunchAgents/com.apple.icloud.fmfd.plist doesn't reveal what it actually does. I'm really hoping someone will come along with a better answer.
    – John Coxon
    Commented Oct 22, 2014 at 16:46
  • 1
    I believe this might be causing 3 of our Mac Pro's to completely freeze for 5 minutes every 2 hours
    – user97385
    Commented Oct 24, 2014 at 9:38
  • 2
    Another data point: fmfd has an application password in my login keychain the name = fmfd-daemon-aps-token, account = fmfd-aps-token-username, set to always allow access by any application in /usr/libexec, which smells like a potential security issue.
    – DaveParillo
    Commented Nov 19, 2014 at 23:45

6 Answers 6

Reset to default
5

I just found how to solve this problem.

  1. Go to the /System/Library/Sandbox/Profiles folder, you will find a file named fmfd.sb. You can't modify it here, so copy it to your desktop.
  2. Open the copy with TextEdit, locate the allow file-read-metadata section and add a new line under (literal "/Volumes") for the folder that can't be read, for you that should be (literal "/Volumes/Macintosh HD").
  3. Replace the original with the copy (don't forget to make a backup), since it's in a system folder it will ask for your password.
  4. Reboot your Mac the error messages in Console should be gone!
Improve this answer
3
  • 2
    Will that pose a security risk? I mean, sandbox files are there for a purpose, aren´t they? If you allow file-read-metadata for the whole disk, the warning may go, but that process can look for all files in my man harddrive!
    – TAKeanice
    Commented Jan 16, 2015 at 11:18
  • 1
    I don't think so, for starters you add the right to read only the metadata, secondly from what I can guess from the other permissions given to fmfd it allow that only for that folder, not its subfolders (else the (literal "/Volumes") would be enough), lastly since it's an Apple process I think that we can trust it, especially for only one folder.
    – Hrist
    Commented Jan 16, 2015 at 15:13
  • Depends... As I said, they don´t write the sandbox files without any reason. If they would be that perfect and safe, they could just run all processes without limitations in kernel mode! But I´ll do your suggested modification anyway, the messages are getting on my nerves!
    – TAKeanice
    Commented Jan 16, 2015 at 15:35
6

fmfd is 'find my friends daemon' I believe. I have noticed on my multiuser iMac that the two logged in users are polling each other's home directories ... though I've not yet figured out why. :-)

Improve this answer
3
  • 1
    I agree, it seems to be requesting files it has no access for. But i doubt it´s the "find my friends daemon", because it is there on Linux systems, too. Unless it has the same acronym but completely different meanings it should be something very basic from UNIX systems
    – TAKeanice
    Commented Oct 31, 2014 at 9:31
  • If you look at the strings in the fmfd binary, it sure seems to be a smoking gun that it does handle Find My Friends server side integration in the background. strings /usr/libexec/fmfd|egrep -i "fmf|location|find|icloud" | egrep -v "<|@"
    – bmike ♦
    Commented Feb 25, 2015 at 16:44
  • 1
    @TAKeanice Blast from the past, but this helped me. All I did to stop the errors in the console and to stop the CPU usage of fmfd is to log out of the other account on my machine — problem solved. You got it 100% right even after 10yrs it applies
    – jv-k
    Commented Jun 2 at 22:36
4

According to Activity Monitor info on fmfd:

This tool generates files that allow Apple to investigate issues with your computer and help improve Apple products. The files might contain personal information found on your device or associated with your iCloud accounts, including but not limited to serial numbers of your device, your device name, your user name, file paths, file names, your computer’s IP addresses, and network connection information. This information is used by Apple in accordance with its privacy policy and is not shared with any other company. By using this tool and sending the results to Apple, you consent to Apple using the contents of these files to improve Apple products.

To see what fmfd is doing sample the process, i.e. open terminal, enter:

sample fmfd
Improve this answer
3
  • hm... Very bad idea to allow something like that crawl your $HOME directory...
    – TAKeanice
    Commented Feb 25, 2015 at 16:52
  • 2
    Where have you actually read this? I don´t see where to find this information
    – TAKeanice
    Commented Mar 21, 2015 at 13:52
  • First helpful answer. So this daemon is collecting usage data and other analytics for Apple, in order to "improve their products". So when you elect NOT to share such data (when installing MacOS for instance) this daemon should have quit? I wonder.
    – Motti Shneor
    Commented Mar 13, 2020 at 5:29
3

fmfd - Find my friends daemon, is part of MacOS, and you probably should let it run. If it experiences errors (and logs them) better try to understand what (else) is broken on your Mac. In your case, I'd try to fix file access rights.

Here is an excerpt from the man pages for fmfd:

fmfd(8)                   BSD System Manager's Manual                  fmfd(8)

NAME
     fmfd -- Find My Friends daemon

SYNOPSIS
     fmfd

DESCRIPTION
     fmfd is the daemon for Find My Friends.

     There are no configuration options to fmfd.  Users should not run it manually.
Mac OS X                        March 13, 2020                        Mac OS X
Improve this answer
2

I think it belongs to "Find My Mac". When you turn it off in Preferences, stops spamming your logs.

Improve this answer
2
  • worked temporarily, but not permanently
    – TAKeanice
    Commented Nov 12, 2014 at 10:03
  • Agree ... I have find my mac disabled and still getting the message pretty regularly.
    – PaulProgrammer
    Commented Dec 10, 2014 at 17:48
0

I got the following error in the console and fmfd was using a constant high % of CPU:

(system) <Warning>: denied lookup: name = com.apple.metadata.mds, flags = 0x8, requestor = fmfd[7144], error = 159: Sandbox restriction

After a lot of head scratching and hair pulling, virus checking, repairing permissions, shutting off Find My, and messing around in Keychain, turns out (as another poster from 2014(!) mentioned above) this issue is related to Find My Friends daemon trying to access something in another user's home directory or something like this.

I had another user logged in to the machine, and immediately after switching to that user and logging out, the process reverted back to using 0% CPU.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .