I've just updated to the latest MacOS 10.13.2 and after restarting, my machine asked me to allow incoming network connections for "rapportd".

After blocking it and checking in the firewall config, I can see that this is an executable in /usr/libexec/rapportd which was created on my machine on the 1st of December.

That's a day after I installed the security update 2017-001 (for the second time; autoupdate didn't seem to notice that I'd manually updated it), and I haven't installed or updated any other software recently / around that time. Google Chrome updates whenever it feels like it, so this could be related to a Chrome update (no idea when it last updated).

The internet suggests this is related to some banking protection program but that doesn't seem to fit here, and from a vague text-edit inspection of the binary I can see that it references /System/Library/PrivateFrameworks/Rapport.framework/Versions/A/Rapport (a framework created on my machine back in July and updated in October) which makes me think this is likely to be a new 1st-party OS daemon.

What does rapportd do?

  • 1
    It has a manpage, but it's not very helpful: "Synopsis: Daemon providing support for the Rapport connectivity framework." – sengi Dec 7 '17 at 22:41
  • 1
    1. Hints from elsewhere suggest to do with local Apple devices connecting (and waking Mac from sleep). 2. There is also a RapportUIAgent in System/Library/CoreServices. 3. There are 2 launch agents. 4. rapportd exists in 10.13.0 but not active. 5. There is /System/Library/Sandbox/profiles/com.apple.rapportd.sb 6. Text in rapportd.sb and in rapportd executable includes airplay, wifi, bluetooth, pairing and homekit. – Gilby Dec 12 '17 at 21:37
  • I think it was your other apple device tried to connect to your mbp. – Vision Chang Mar 20 '18 at 8:36
  • Don't know much about this kind of stuff, but have noticed that the incoming attempt to conect is coming from my iPhone (it's the IP address my iPhone is connected). – Gui Apr 29 '18 at 23:56
  • I came here because of the bonjour service rapportd advertises. The output of "dns-sd -B _services._dns-sd._udp" is "_tcp.local. _companion-link" which is misspelled as "Compagnion link" Service Type in iNet Network Scanner. Misspellings in unknown Bonjour services trip my malware detector. Even with Handoff off, this service stays running. I guess Apple needs to be able to keep phones/tablets/laptops connected at all costs. After checking with codesign I guess rapportd is first party. Why so obscure though. – geoO Jan 21 at 15:55

The man page states:

Daemon providing support for the Rapport connectivity framework.

Checking the code signature with codesign -dv --verbose=4 /usr/libexec/rapportd shows it is signed by Apple and, since it's linked against a PrivateFramework (which Apple doesn't allow for others) and in a SIP-protected location (unless you turned off SIP), this appears to be legitimate Apple software. The man page implies it's related to communication, though I've yet to find any real documentation on it.

(Thanks to John Keates for the code-signature tip.)

Continuity Camera on your Mac also facilitates rapportd:

  • In your macOS first party apps such as Notes.app or Pages.app you can issue the command "Take Photo", which opens the camera app on your iPhone or iPad.
  • This also triggers an incoming connection to rapportd (about 1.2 Megabytes for each photo coming from an iPhone 6S, observed with LittleSnitch)
| improve this answer | |
  • Just because Apple authorized it, doesn't make it "legitimate". Apple has been gathering and sharing information about its users with state security organs since October 2012. I don't have an iPhone and don't want a security hole open to share with other Apple devices. – Foliovision Jun 2 '18 at 16:38
  • 4
    "it's linked against a PrivateFramework (which Apple doesn't allow for others)": Apple doesn't care about this, unless you're planning to distribute through the App Store. In fact, one the apps I work on links to a private framework and Apple let us sign it just fine. – saagarjha Jun 3 '18 at 18:57

In addition to what already has been posted, /usr/libexec/rapportd is code signed by Apple and linked against a PrivateFramework (which Apple doesn't allow for others and therefore doesn't sign for others), and in a SIP-protected location. Unless you turn off SIP, this is simply part of the OS, put there by Apple.

You can check this on the commandline:

codesign -vvvv -R="anchor apple" /usr/libexec/rapportd

This should report something like:

/usr/libexec/rapportd: valid on disk
/usr/libexec/rapportd: satisfies its Designated Requirement
/usr/libexec/rapportd: explicit requirement satisfied

To show what libraries are linked to:

otool -L /usr/libexec/rapportd

Which will show something like:

    /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 1450.14.0)
    /System/Library/PrivateFrameworks/CoreUtils.framework/Versions/A/CoreUtils (compatibility version 1.0.0, current version 1.0.0)
    /System/Library/PrivateFrameworks/Rapport.framework/Versions/A/Rapport (compatibility version 0.0.0, current version 0.0.0)
    /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (compatibility version 300.0.0, current version 1450.14.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)
| improve this answer | |
  • 2
    "which Apple doesn't allow for others and therefore doesn't sign for others": Try it yourself; you'll see that it works just fine: echo 'int main() {}' | clang -F/System/Library/Frameworks -framework MobileDevice -x c - -o test; codesign -s "Your certificate" test – saagarjha Jun 3 '18 at 19:07
  • PrivateFrameworks, and codesigned by Apple, not Frameworks and codesigned locally by yourself. – John Keates Jun 3 '18 at 20:57
  • 4
    Sorry, I meant echo 'int main() {}' | clang -F/System/Library/PrivateFrameworks -framework MobileDevice -x c - -o test; codesign -s "Your certificate" test. A rather unfortunate typo given what we're discussing. Also, I signed this with my Mac Developer certificate, not an ad-hoc one. – saagarjha Jun 4 '18 at 9:59

I believe it is used for iTunes Home Sharing and the Remote app to control iTunes.

I found this out because Little Snitch was blocking it and I couldn't work out why the iTunes remote stuff wasn't working because I accidentally closed the dialog :)

Once I allowed it my phone could then see iTunes on my laptop as well as discover the iTunes Home Sharing.

| improve this answer | |
  • I've never synced an iOS device on this machine but I do use iTunes home sharing, and have rapportd running with TCP *:65530 (LISTEN) open on both ipv4 and ipv6, I thought port 65530 was a pretty cheeky high port number just six below the highest possible but thankfully it sounds like legit software hopefully – Tomachi Aug 23 '19 at 13:16

Type man rapportd in Terminal. This is the output:

     rapportd -- Rapport Daemon.

     Daemon that enables Phone Call Handoff and other communication features between Apple devices.

     Use '/usr/libexec/rapportd -V' to get the version.

| improve this answer | |

From my own pain^W experience I can tell that this service is needed at least for text message forwarding (relaying) to work.

Having it blocked with Firewall, for e. g., puts a big bold ban on "Text Message Forwarding" item in iPhone's settings. In fact it won't be even shown at all there

enter image description here

| improve this answer | |
  • Interesting. I have blocked rapportd on my machine yet both iMessages and text message forwarding are still working fine for me. Is it possible you also have another blocked service? – Dave Feb 22 '18 at 18:26
  • How did you block? Did you try rebooting after you did that? – poige Feb 22 '18 at 22:43
  • By choosing “deny” when it asked, as noted in my original question (and it is still listed as blocked in the firewall settings). And yes I have rebooted many times since then. – Dave Feb 23 '18 at 8:26
  • You can check for sure with traffic sniffer and/or netstat/lsof – poige Feb 23 '18 at 9:56

(edit: I corrected my previous mix up of UID and PID - apologies to everyone!!!)

I checked what files this process has open, and that doesn't help much either. However, at least I know now what port it's trying to listen on (49161) and I can search hopefully what this port is "reserved" for (it's a high port, so it's not really reserved as such, yeah I know).

[username]mbp:~ root# ps -ef |grep -i [r]apport
  501   306     1   0 10:52AM ??         0:00.11 /usr/libexec/rapportd
[username]mbp:~ root# lsof -p 306
rapportd 306 [username]  cwd    DIR                1,4        992          2 /
rapportd 306 [username]  txt    REG                1,4      44768 8591706461 /usr/libexec/rapportd
rapportd 306 [username]  txt    REG                1,4     837248 8591705719 /usr/lib/dyld
rapportd 306 [username]  txt    REG                1,4 1155805184 8591716537 /private/var/db/dyld/dyld_shared_cache_x86_64h
rapportd 306 [username]    0r   CHR                3,2        0t0        308 /dev/null
rapportd 306 [username]    1u   CHR                3,2        0t0        308 /dev/null
rapportd 306 [username]    2u   CHR                3,2        0t0        308 /dev/null
rapportd 306 [username]    3u  IPv4 0x571b821607c38e93        0t0        TCP *:49161 (LISTEN)
rapportd 306 [username]    4u  IPv6 0x571b82160763854b        0t0        TCP *:49161 (LISTEN)
rapportd 306 [username]    5u  unix 0x571b821607941573        0t0            ->0x571b821607941c7b
rapportd 306 [username]    6u  unix 0x571b82160794069b        0t0            ->0x571b82160794050b
| improve this answer | |
  • 1
    Please elaborate on what a backdoor means to you here? – bmike Dec 8 '17 at 12:06
  • 501 is the UID, not the PID! You need to lsof -p 306 for this process – Dave Dec 8 '17 at 12:36
  • sorry for the UID/PID confusion - I've corrected it now. – cepal67 Dec 9 '17 at 9:11

Have you recently agreed to install software to protect communications with your bank? https://en.wikipedia.org/wiki/Trusteer#Trusteer_Rapport

| improve this answer | |
  • 1
    That software makes me cringe. It seems to be super heavy and have tons of vulnerabilities and in fact makes people security far worse. I think this is Apple software however and not the link you mentioned - just that the names are the same. – bmike Aug 23 '18 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .