Loginwindow tried to hijack service?

Question

I was looking at my system.log for another issue I was trying to fix, and noticed after a reboot that I had a service hijack attempt, I then noticed that the process that was trying to hijack was called loginwindow.107. Below is the terminal output for relevant lines in system.log:

Nick@MacBook-Pro:/var/log$ cat system.log | grep loginwindow
Mar  5 02:46:43 NicksMBP com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.107.4294967295): Service sets EnableTransactions=false and EnablePressuredExit=true, which makes no sense. Enabling Transactions.
Mar  5 02:46:43 NicksMBP com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.107.4294967295): Service sets EnableTransactions=false and EnablePressuredExit=true, which makes no sense. Enabling Transactions.
Mar  5 02:46:43 NicksMBP com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.107.4294967295): Service sets EnableTransactions=false and EnablePressuredExit=true, which makes no sense. Enabling Transactions.
Mar  5 02:46:43 NicksMBP com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.107.4294967295): Service sets EnableTransactions=false and EnablePressuredExit=true, which makes no sense. Enabling Transactions.
Mar  5 02:46:43 NicksMBP com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.107.4294967295): com.apple.noticeboard.agent: EnablePressuredExit is not compatible with KeepAlive=true. Ignoring EnablePressuredExit.
Mar  5 02:46:43 NicksMBP com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.107.4294967295): Service sets EnableTransactions=false and EnablePressuredExit=true, which makes no sense. Enabling Transactions.
Mar  5 02:46:43 NicksMBP com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.107.4294967295): Service sets EnableTransactions=false and EnablePressuredExit=true, which makes no sense. Enabling Transactions.
Mar  5 02:46:43 NicksMBP loginwindow[107]: objc[107]: Class AMSupportURLConnectionDelegate is implemented in both /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice (0x7fffb5eca6e0) and /usr/lib/libFDR_osx.dylib (0x10ac56ad8). One of the two will be used. Which one is undefined.
Mar  5 02:46:43 NicksMBP loginwindow[107]: objc[107]: Class AMSupportURLConnectionDelegate is implemented in both /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice (0x7fffb5eca6e0) and /System/Library/PrivateFrameworks/EmbeddedOSInstall.framework/EmbeddedOSInstall (0x10abbfde8). One of the two will be used. Which one is undefined.
Mar  5 02:46:51 MacBook-Pro loginwindow[107]: USER_PROCESS: 107 console
Mar  5 02:46:51 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100007.Aqua): Caller tried to hijack service: path = /System/Library/LaunchAgents/com.apple.pluginkit.pkd.plist, caller = loginwindow.107
Mar  5 02:46:51 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100007.Aqua): Caller tried to hijack service: path = /System/Library/LaunchAgents/com.apple.storeinstallagent.plist, caller = loginwindow.107
Mar  5 02:46:51 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100007.Aqua): Caller tried to hijack service: path = /System/Library/LaunchAgents/com.apple.trustd.agent.plist, caller = loginwindow.107
Nick@MacBook-Pro:/var/log$ 

Is this normal? Can someone help me understand what is happening here?

Answer 1

This is normal and something that Apple clears up most of the time and is almost always harmless when it’s Apple code dropping two versions of the library.

See this other example - How to fix the error: "AppleSpell" tried to hijack endpoint "it (Apple)_OpenStep" from owner?

XPC is an inter-process call where one part of a program calls out to another to do something, so these frameworks have a default location - see the actual warning that the same “name” is defined in two places, so Apple would patch that up going forward when you apply updates.

I’d focus on anything actually not working and then we can dig into it - you could get breakage if older code calls a newer version, so perhaps Apple shipped this during a transition period from older usage to a newer implementation.