Transparent network proxy for Apple system services wants to use the "login" keychain

Question

I recently changed my M1 Mac 2021 Ventura 13.2.1 user password for I think the first time since buying, and this resulted in my default keychain password being out of sync with my login, so it prompts me for access.

This meant I got visibility into what is asking for the keychain.

I searched my keychain for "transpare" and found an old entry for

And also a more recent entry from today for com.apple.account.AppleAccount.key-transparency-token Edit :

summary: its trying to open (and does, maybe thanks to iCloud already having access to keychain, if its related) "Db networkserviceproxy". Need to do more research but seems related to apples TCC

OK, bit of a mac novice (obviously) but here is what I found.

In activity monitor there is a transparencyd running with is opening various files including:

/ (root!)
    /usr/libexec/transparencyd
    Library/Application Support/com.apple.transparencyd/TransparencyModel.sqlite-shm
    Library/Caches/com.apple.transparencyd/Cache.db-shm
/Users/USER/Library/Keychains/0708FDBC-1....86A1F2/Analytics/TransparencyAnalytics.db
/Users/USER/Library/Keychains/0708FDBC-137E-5...A1F2/Analytics/TransparencyAnalytics.db-wal
/Users/USER/Library/Keychains/0708FDBC-137E-5.....F2/Analytics/TransparencyAnalytics.db-shm

/private/var/db/mds/messages/501/se_SecurityMessages
/Users/USER/Library/Caches/com.apple.transparencyd/Cache.db-shm
/usr/share/icu/icudt70l.dat

And nothing suspicious.

com.apple.transparency - I found this post, here is the testing :

So, tailing the keychain log shows :

log stream --predicate 'subsystem == "com.apple.securityd" AND message CONTAINS[cd] "Keychain Access"' --info --debug --signpost --style compact

And waiting for it to request, but meanwhile, a query of the log for "Transparency" shows :

Filtering the log data using "subsystem == "com.apple.securityd" AND composedMessage CONTAINS[cd] "Transparency""
Timestamp               Ty Process[PID:TID]
 Df securityuploadd[84..] [com.apple.securityd:supd] created TransparencyTopic with 259200 seconds between uploads, 1000 max events, 100.000000 percent of uploads
 Df securityuploadd[84..432] [com.apple.securityd:getURL] Not going to talk to server for topic TransparencyTopic because no eligible clients
 Df securityuploadd[840..32] [com.apple.securityd:upload] Skipping upload for TransparencyTopic because no endpoint
 Df securityuploadd[935..d9f] [com.apple.securityd:supd] created TransparencyTopic with 259200 seconds between uploads, 1000 max events, 100.000000 percent of uploads
 Df securityuploadd[935..dac] [com.apple.securityd:getURL] Not going to talk to server for topic TransparencyTopic because no eligible clients
 Df securityuploadd[9350..ac] [com.apple.securityd:upload] Skipping upload for TransparencyTopic because no endpoint

Edit 2 :

Eventually the popup returned, and when I cancel it, log shows:

 Db networkserviceproxy[549..921] [com.apple.securityd:security_exception] 8   Security
0x00000001a...a70 Security::KeychainCore::ItemImpl::checkIntegrityFromDictionary(Security::CssmClient::AclBearer&,
Security::CssmClient::DbAttributes*) + 116
2023 Db networkserviceproxy[549..921] [com.apple.securityd:security_exception] 9   Security
0x00000001a2...f4 Security::KeychainCore::ItemImpl::checkIntegrity(Security::CssmClient::AclBearer&) + 68
2023 Db networkserviceproxy[5498..921] [com.apple.securityd:security_exception] 10  Security
0x000000..58c0 Security::KeychainCore::ItemImpl::checkIntegrity() + 136
2023 Db networkserviceproxy[54985:149921] [com.apple.securityd:security_exception] 11  Security
0x0000000...1f20 Security::KeychainCore::ItemImpl::getContent(Security::CssmClient::DbAttributes*,
Security::CssmDataContainer*) + 272
2023 Db networkserviceproxy[549..921] [com.apple.securityd:security_exception] 12  Security
0x00000..6738 Security::KeychainCore::ItemImpl::getContent(SecItemClass*, SecKeychainAttributeList*, unsigned int*,
void**) + 784
2023- Db networkserviceproxy[549...921] [com.apple.securityd:security_exception] 13  Security
0x00000...cef8 SecKeychainItemCopyContent + 256
2023 Db networkserviceproxy[5498..921] [com.apple.securityd:security_exception] 14  Security
0x00000..ee1c AddItemResults(__SecKeychainItem*, __SecIdentity*, SecItemParams*, __CFAllocator const*, __CFArray**,
void const**) + 608
2023 Db networkserviceproxy[549..21] [com.apple.securityd:security_exception] 17
NetworkServiceProxy                 0x0000..f62c +[NPUtilities copyDataFromKeychainWithIdentifier:accountName:] + 236

And :

2023 Db networkserviceproxy[549..21] [com.apple.securityd:atomicfile] 0x12db3b430 free /Users/USER/Library/Keychains/login.keychain-db buffer 0x120098000
2023 Db networkserviceproxy[549..21] [com.apple.securityd:atomicfile] 0x12db31410 opened /Users/USER/Library/Keychains/login.keychain-db: 426444 bytes
2023 Db networkserviceproxy[5498..21] [com.apple.securityd:atomicfile] 0x12db31410 allocated /Users/USER/Library/Keychains/login.keychain-db buffer 0x120098000 size 4
2023 Db networkserviceproxy[549..21] [com.apple.securityd:atomicfile] 0x12db31410 closed /Users/USER/Library/Keychains/login.keychain-db

Edit 3 :

I didn't let iCloud have keychain access, and, following this the "transparenct network proxy" will repeatedly ask for keychain access, suggesting to me that it was borrowing the previous iCloud access but without it, seems to really want it. So I guess this is linked to Apple's attempts to backup the keychain but why this needs an intercept proxy maybe someone more knowledgeable can say.

Answer 1

You haven't really pinned out what your question exactly is - but mainly I see that you have confusion as to what transparencyd actually is. I.e. you're trying to determine its function and ends at a suspicion that it is some type of transparent network proxy.

In actuality, the transparencyd is there not to make network proxying transparent, but rather to make transparent to you - the user - which applications are tracking your personal data.

I.e. when an applications needs to access personal data, such as for example your Contacts, it will go through transparencyd in order for you as the user to be informed and to be able to make a decision on whether or not to allow that. This is what is meant by transparency.

As a user, when the application is in the foreground, you'll receive a popup dialog stating what the application is trying to access, and be asked whether or not to allow that. The transparency system then remembers that information for the next time that particular application needs to access that information again, so you are not bogged down by popups all the time.

UPDATE

From your comment, I gather that your actual question is "What 'Transparent network proxy for Apple System services' is? and is it legitimate?".

Yes, it is legitimate. That is a perfectly normal part of a macOS standard installation provided by Apple.

The actual program is NetworkServiceProxy - part of the NetworkServiceProxy framework. Its function is to implement Apple's Private Relay functionality on your computer. Basically this program gathers configuration information from Apple's cloud servers to setup what you could think of as a kind of "VPN" that, amongst other things, helps keep your communication with Apple's cloud services private.

Private Relay has some other functionalities as well as helping you to keep your privacy when browsing the web in Safari, when looking up host names on the Internet, etc. You can read about Private Relay here.