I'm getting many of these two similar errors on my console.

10/21/15 11:06:29.737 AM sandboxd[140]: ([368]) SpotlightNetHelp(368) deny file-read-data / 10/21/15 11:07:11.000 AM kernel[0]: Sandbox: SpotlightNetHelp(368) deny(1) file-read-data /

I've check the extended attributes of / to see if it's quarantined, but there are none:

$ xattr / 

Root / is owned by root and in group wheel with permissions drwxr-xr-x. For what it's worth, other Spotlight errors include many

10/21/15 10:53:49.623 AM SpotlightNetHelper[368]: tcp_connection_tls_session_error_callback_imp 276 __tcp_connection_tls_session_callback_write_block_invoke.434 error 22

where 276 so far varies up to 293. What could be causing these deny file-read-data errors, and what can I do about it?

  • Are you on El Capitan / Did you enable SIP ? – StrawHara Oct 21 '15 at 15:30
  • 1
    I am on El Capitan, but I had these errors before upgrading. I haven't taken any action to enable SIP (this is the first I've heard of it). – Merchako Oct 21 '15 at 15:32
  • Apple has enabled a new default security oriented featured called System Integrity Protection, often called rootless, in OS X 10.11 onward. The rootless feature is aimed at preventing Mac OS X compromise by malicious code, whether intentionally or accidentally, and essentially what SIP does is lock down specific system level locations in the file system while simultaneously preventing certain processes from attaching to system-level processes. osxdaily.com/2015/10/05/… – StrawHara Oct 21 '15 at 15:50
  • Tons of these lines are placed in my logs along before SIP & El Capitan – adnako Oct 26 '15 at 10:45

You must log in to answer this question.

Browse other questions tagged .