2

I recently changed my M1 Mac 2021 Ventura 13.2.1 user password for I think the first time since buying, and this resulted in my default keychain password being out of sync with my login, so it prompts me for access.

This meant I got visibility into what is asking for the keychain.

keychain request

I searched my keychain for "transpare" and found an old entry for

transparency.storage

And also a more recent entry from today for com.apple.account.AppleAccount.key-transparency-token Edit :

summary: its trying to open (and does, maybe thanks to iCloud already having access to keychain, if its related) "Db networkserviceproxy". Need to do more research but seems related to apples TCC

OK, bit of a mac novice (obviously) but here is what I found.

In activity monitor there is a transparencyd running with is opening various files including:

/ (root!)
    /usr/libexec/transparencyd
    Library/Application Support/com.apple.transparencyd/TransparencyModel.sqlite-shm
    Library/Caches/com.apple.transparencyd/Cache.db-shm
/Users/USER/Library/Keychains/0708FDBC-1....86A1F2/Analytics/TransparencyAnalytics.db
/Users/USER/Library/Keychains/0708FDBC-137E-5...A1F2/Analytics/TransparencyAnalytics.db-wal
/Users/USER/Library/Keychains/0708FDBC-137E-5.....F2/Analytics/TransparencyAnalytics.db-shm

/private/var/db/mds/messages/501/se_SecurityMessages
/Users/USER/Library/Caches/com.apple.transparencyd/Cache.db-shm
/usr/share/icu/icudt70l.dat

And nothing suspicious.

com.apple.transparency - I found this post, here is the testing :

So, tailing the keychain log shows :

log stream --predicate 'subsystem == "com.apple.securityd" AND message CONTAINS[cd] "Keychain Access"' --info --debug --signpost --style compact

And waiting for it to request, but meanwhile, a query of the log for "Transparency" shows :

Filtering the log data using "subsystem == "com.apple.securityd" AND composedMessage CONTAINS[cd] "Transparency""
Timestamp               Ty Process[PID:TID]
 Df securityuploadd[84..] [com.apple.securityd:supd] created TransparencyTopic with 259200 seconds between uploads, 1000 max events, 100.000000 percent of uploads
 Df securityuploadd[84..432] [com.apple.securityd:getURL] Not going to talk to server for topic TransparencyTopic because no eligible clients
 Df securityuploadd[840..32] [com.apple.securityd:upload] Skipping upload for TransparencyTopic because no endpoint
 Df securityuploadd[935..d9f] [com.apple.securityd:supd] created TransparencyTopic with 259200 seconds between uploads, 1000 max events, 100.000000 percent of uploads
 Df securityuploadd[935..dac] [com.apple.securityd:getURL] Not going to talk to server for topic TransparencyTopic because no eligible clients
 Df securityuploadd[9350..ac] [com.apple.securityd:upload] Skipping upload for TransparencyTopic because no endpoint

Edit 2 :

Eventually the popup returned, and when I cancel it, log shows:

 Db networkserviceproxy[549..921] [com.apple.securityd:security_exception] 8   Security
0x00000001a...a70 Security::KeychainCore::ItemImpl::checkIntegrityFromDictionary(Security::CssmClient::AclBearer&,
Security::CssmClient::DbAttributes*) + 116
2023 Db networkserviceproxy[549..921] [com.apple.securityd:security_exception] 9   Security
0x00000001a2...f4 Security::KeychainCore::ItemImpl::checkIntegrity(Security::CssmClient::AclBearer&) + 68
2023 Db networkserviceproxy[5498..921] [com.apple.securityd:security_exception] 10  Security
0x000000..58c0 Security::KeychainCore::ItemImpl::checkIntegrity() + 136
2023 Db networkserviceproxy[54985:149921] [com.apple.securityd:security_exception] 11  Security
0x0000000...1f20 Security::KeychainCore::ItemImpl::getContent(Security::CssmClient::DbAttributes*,
Security::CssmDataContainer*) + 272
2023 Db networkserviceproxy[549..921] [com.apple.securityd:security_exception] 12  Security
0x00000..6738 Security::KeychainCore::ItemImpl::getContent(SecItemClass*, SecKeychainAttributeList*, unsigned int*,
void**) + 784
2023- Db networkserviceproxy[549...921] [com.apple.securityd:security_exception] 13  Security
0x00000...cef8 SecKeychainItemCopyContent + 256
2023 Db networkserviceproxy[5498..921] [com.apple.securityd:security_exception] 14  Security
0x00000..ee1c AddItemResults(__SecKeychainItem*, __SecIdentity*, SecItemParams*, __CFAllocator const*, __CFArray**,
void const**) + 608
2023 Db networkserviceproxy[549..21] [com.apple.securityd:security_exception] 17
NetworkServiceProxy                 0x0000..f62c +[NPUtilities copyDataFromKeychainWithIdentifier:accountName:] + 236

And :

2023 Db networkserviceproxy[549..21] [com.apple.securityd:atomicfile] 0x12db3b430 free /Users/USER/Library/Keychains/login.keychain-db buffer 0x120098000
2023 Db networkserviceproxy[549..21] [com.apple.securityd:atomicfile] 0x12db31410 opened /Users/USER/Library/Keychains/login.keychain-db: 426444 bytes
2023 Db networkserviceproxy[5498..21] [com.apple.securityd:atomicfile] 0x12db31410 allocated /Users/USER/Library/Keychains/login.keychain-db buffer 0x120098000 size 4
2023 Db networkserviceproxy[549..21] [com.apple.securityd:atomicfile] 0x12db31410 closed /Users/USER/Library/Keychains/login.keychain-db

Edit 3 :

I didn't let iCloud have keychain access, and, following this the "transparenct network proxy" will repeatedly ask for keychain access, suggesting to me that it was borrowing the previous iCloud access but without it, seems to really want it. So I guess this is linked to Apple's attempts to backup the keychain but why this needs an intercept proxy maybe someone more knowledgeable can say.

1 Answer 1

2

You haven't really pinned out what your question exactly is - but mainly I see that you have confusion as to what transparencyd actually is. I.e. you're trying to determine its function and ends at a suspicion that it is some type of transparent network proxy.

In actuality, the transparencyd is there not to make network proxying transparent, but rather to make transparent to you - the user - which applications are tracking your personal data.

I.e. when an applications needs to access personal data, such as for example your Contacts, it will go through transparencyd in order for you as the user to be informed and to be able to make a decision on whether or not to allow that. This is what is meant by transparency.

As a user, when the application is in the foreground, you'll receive a popup dialog stating what the application is trying to access, and be asked whether or not to allow that. The transparency system then remembers that information for the next time that particular application needs to access that information again, so you are not bogged down by popups all the time.

UPDATE

From your comment, I gather that your actual question is "What 'Transparent network proxy for Apple System services' is? and is it legitimate?".

Yes, it is legitimate. That is a perfectly normal part of a macOS standard installation provided by Apple.

The actual program is NetworkServiceProxy - part of the NetworkServiceProxy framework. Its function is to implement Apple's Private Relay functionality on your computer. Basically this program gathers configuration information from Apple's cloud servers to setup what you could think of as a kind of "VPN" that, amongst other things, helps keep your communication with Apple's cloud services private.

Private Relay has some other functionalities as well as helping you to keep your privacy when browsing the web in Safari, when looking up host names on the Internet, etc. You can read about Private Relay here.

5
  • Sort of. I understand from you that* transparencyd is legit but I can't confirm this specific request for "transparent network proxy" is coming from it. The log shows it comes from networkproxyd. Is that a connection? Thanks for your help
    – Jon Smith
    Commented Mar 27, 2023 at 8:37
  • @JonSmith I have updated the answer. The request is not from transparencyd, no. If your question is about the first prompt, then that concerns Apple's Private Relay feature.
    – jksoegaard
    Commented Mar 27, 2023 at 10:24
  • Thank you very much, but when I go to settings > tap my name > "Private Relay" is set to "off". Is it perhaps doing some kind of check despite that?
    – Jon Smith
    Commented Mar 29, 2023 at 2:32
  • Yes, it is. …..
    – jksoegaard
    Commented Mar 29, 2023 at 5:26
  • Thank you, your help was the difference between hours of additional work.
    – Jon Smith
    Commented Mar 31, 2023 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .