3

I had this pop up unexpectedly (MacOS Ventura 13.5.1, Intel i7 MacBook Pro):

Do you want the application “qemu-system-x86_64” to accept incoming network connections?

System dialog

No recent updates or new software that I'm aware of, not running any applications I haven't used every day for months

Based on this different question I looked in ActivityMonitor and it seems qemu-system-x86_64 is being run by launchd(1) via kernal_task (1) via kernal_task (0):

ActivityMonitor windows

So, it seems like a legit internal system process, I just don't understand why it would suddenly need to accept incoming connections, or why it doesn't have all the permissions it needs out of the box.

1 Answer 1

1

I figured it out:

  • In ActivityMonitor, if the "Parent process" doesn't offer clues as to why something is running, using the "Sample" button then digging through the output can give clues.
  • In my case, qemu was hosting a legitimate Android emulator I hadn't realised was still running in the background
  • Apparently unexpected "incoming connections" dialogs are not uncommon in recent MacOS versions and are usually caused by some change to the application's signature

I tried the ActivityMonitor "Sample" button as suggested in this forum thread (apparently that user's qemu was hosting miner malware from a bad torrent 😬).

In the sample output, I saw a lot of references to dylib and some to android like this:

    +   1560 _pthread_start  (in libsystem_pthread.dylib) + 125  [0x...8037ae1d3]
    +     1560 android::base::Thread::thread_main(void*)  (in libandroid-emu-metrics.dylib) + 155  [0x...c674b]
    +       1560 std::__function::__func<android::base::FunctorThread::FunctorThread<void (*)(), void*>(void (*&&)(), android::base::ThreadFlags)::'lambda'(), long ()>::operator()()  (in qemu-system-x86_64) + 7  [0x...2e0cd7]

A little digging around found an old Android emulator was running in the background, and it was using qemu-system-x86_64 presumably to emulate the Android OS architecture. Closing the emulator made qemu-system-x86_64 disappear from ActivityMonitor.


This particular emulator must have been sat in the background untouched for at least a few weeks, so I still don't understand why its need for "incoming network connections" permissions would have changed today, but at least I know why it was running at all.

Looking at my Firewall settings under Network in system settings, it had apparently already been granted access to incoming connections previously, so it's odd that it decided to ask again today. However, looking at the many other questions and threads complaining about unexpected "accept incoming connections" dialogs I suspect this is common and not cause for concern, probably caused by some small under-the-hood update or expiration.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .