10

I found in my newly installed macOS system there is a service running on port 61500 and the process command is /usr/libexec/xartstorageremoted

I issued man xartstorageremoted and found the manual of this deamon. After reading it I still don't understand what is this deamon used for. I searched Google and there is nearly nothing about it. Does anyone know something about it? What it used for in a common user's perspective?

The xartstorageremoted executable is a daemon intended to listen for save/fetch requests from the CoProcessor. This daemon is required for multi-partitions and multi-users support.

xartstorageremoted must not be unloaded and should only be run via launchd when a request must be handled.

13

In the MacBook's with Touch Bar there is a new processor, Apple’s T1 processor.

The deamon xartstorageremoted talks with the T1 processor.

Secure Enclave is part of it meaning it’s tied explicitly to the Touch Bar and Touch ID. It’s also in charge of your webcam, a small but important difference.

  • @bitweaver you should accept the answer. – jamescampbell Jul 24 at 4:09
7

Nice. Something poorly documented, yet in charge of a webcam and Touch ID, opens a global listener socket under the root account.

root# lsof -i tcp

xartstora 13594      root    3u  IPv4 0x30c82343150af2cf      0t0  TCP *:61500 (LISTEN)
xartstora 13594      root    4u  IPv6 0x30c82343150af2cf      0t0  TCP *:61500 (LISTEN)

I'd understand if it opened a UNIX domain socket or bound to 127.0.0.1 but binding to 0.0.0.0 (*) is a security problem from my point of view.

  • Well now I'm curious as to what this is... – JMY1000 Jan 19 '18 at 18:52
  • Found out what it is yet? – Cristiano Coelho Oct 24 '18 at 2:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .