13

I am on High Sierra, and I have opened Console. I am seeing TONS of authd : MacOS error -67050 and sometimes -67062. Sometimes I see this on taskgated and also iCal.

What can I do to trace what causes this?

4
  • 1
    Could you quantify tons? Can you post the specific syntax you are seeing? 10,000 messages a day from the same error really take no measurable resources now that Apple logging is so efficient. Is there a specific failure you are seeing or are you just nervous / worried?
    – bmike
    Jan 15, 2018 at 1:41
  • @bmike It's multiple per second. I wouldn't say "nervous", I want to know what these errors are, what they mean, and whether it's something I can fix.The error messages only say "MacOS error: -67062"
    – Tommy
    Jan 15, 2018 at 14:25
  • I first noticed these messages over a year ago on a 2015 15" MBP Retina running Sierra. My current machine is a 2016 13" MBP with touchbar running fully updated High Sierra and the messages persist. The built-in "security" command line utility can be used to "Display a descriptive message for the given error code(s)", i.e.: $ security error -67050 Error: 0xFFFEFA16 -67050 code failed to satisfy specified code requirement(s) $ security error -67062 Error: 0xFFFEFA0A -67062 code object is not signed at all Seems pretty sketchy to me, but I haven't been able to figure out what's causing the messa
    – user273942
    Jan 27, 2018 at 1:24
  • 2
    It's a waste of resources and bandwidth. I just want it to stop. discussions.apple.com/thread/7705551 and reposted discussions.apple.com/message/33352270#33352270
    – Bruce Edge
    Apr 30, 2018 at 17:38

1 Answer 1

3

This error occurs when unsigned code is run. The taskgated process is the one checking if the executable is signed. In order to check, it must open the file. So to track down what is being opened by the process you can use dtruss (you may have install the Xcode command line tools to get it). Just create the following file named unsigned.pl:

#!/usr/bin/perl

use strict;
use warnings;

open my $fh, "-|", "dtruss -p `ps -ef | grep taskgated | grep -v grep | awk '{print \$2}'` -t open 2>&1";

while (my $line = <$fh>) {
        my ($file) = $line =~ /open\("(.*)\\0"/;

        next unless defined $file and -f $file;

        my $signed = qx/codesign -dvvv "$file"/;

        print $signed;
}

Which can be run like this:

sudo perl unsigned.pl

and it will spit out lines like

/path/to/executable: code object is not signed at all

You can then create a self signed cert with Keychain Access:

  1. launch the Keychain Access app
  2. go to Keychain Access > Certificate Assistance > Create a Certificate...
  3. set the name to something like codesigner
  4. set the certificate type to Code Signing
  5. create the cert

Once you have a self-signed cert you can sign the executables in the terminal with

codesign -s codesigner /path/to/executable

Note: you will see a lot of examples using -f, but that forces it to be resigned with the new cert. If you have lost access to the cert, or if the cert has expired, that might be necessary, but I try to avoid it.

1
  • Looks like the ps ... commands between the back ticks can be replaced with pgrep taskgate. • Those commands get the Proccess ID of taskgated. • pgrep gets the PID of any process whose name contains the search expression.
    – Mat Gessel
    Jan 25, 2021 at 3:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .