3

I just noticed that on my personal computer there are some processes owned by another account. This account has been set up by myself for my children and is almost never used. I just logged in a few months ago to test something from another account after a suggestion on this forum.

The processes are:

  • distnoted
  • containermanagerd
  • csnameddatad
  • pkd
  • mdbulkimport
  • secd
  • Isd
  • cfprefsd
  • trustd

I specifically closed the session from this user (whose password I have), to no avail.
After restarting my computer last night and logging in, the processes had disappeared, but this morning they reappeared.

I completely rule out my children logging in. They are hundreds of km away and likely not even aware of this account I set up when they were infants and never used.

The processes do not consume any CPU, and I kind of believe it is a sort of totally harmless maintenance thing macOS is doing.

Still, I'm puzzled. I am the only person who logs in on the computer. How can there be another user logged in? Why aren't they killed when I close the user session?

Should I or could I take any action to prevent this from happening?

Thanks.

Context: I'm under Monterey, Intel Mac, and I recently made on my account a lot of migration on external hardware.

EDIT 2: Adding some context for my question: as said, I was not particularly worried by the risk of unwanted intrusion. However, I always considered that having a look on the current live processes and unknown users logged was the first step to diagnose and avoid that. One weakness of my installation is the existence on the local network of old computers used by my kids with weak passwords and old OS that could remotely try to log on my personal computer impersonating them. Even If I try to keep sharing permissions to the minimum, there is always the risk of a new exploit.

It seems that the basic checking of the absence of these accounts is now not enough. Either I let go, either I suppress them, either I change the name of the account.

EDIT: For those interested, the processes, still alive after entering then exiting the session on the user account, are listed here (again under Monterey, 12.7.1):

process Monitor screenshot

2
  • As for why these things run in separate "users", and not just a big "system" user, is because "user"s, human or not, are a way of assigning permissions to processes and resources. Classic example is two non-adminstrator human users not being able to access eachother's documents, but there are a myriad more specific ways of ensuring processes don't do thinks they aren't supposed to.
    – Kroltan
    Commented Dec 11, 2023 at 13:14
  • 1
    @Kroltan Thanks, I'm well aware of Unix permission system and the existence of multiple process owned by non human users. However, up to recently, MacOS would not launch a human-user owned process when this human had not explicitly logged in. Hence my question.
    – Hugues
    Commented Dec 11, 2023 at 14:54

2 Answers 2

3

The user owning these processes does not need to be logged in for them to be running. They are largely daemons associated with background processing, as you correctly surmise, for that user's data, especially iCloud related.

An advantage to this is that iCloud related synchronisations have been performed before the user logs-on, and thus does not have to wait.

They will have been restarted by launchd as required, hence their reappearance.

If you really don't want to see them, and the associated accounts are unused, then the best course would be to remove the accounts.

6
  • Thanks for your answer. I don't really think it's iCloud specifically as this account has no Apple ID registered, and hence no iCloud account. After your comment, I saw a lot of activity from triald which from what I just read seems to be related to Siri optimisations and Mac OS Machine Learning experimentations.
    – Hugues
    Commented Dec 10, 2023 at 13:19
  • 3
    I'm assuming Andy was mentioning iCloud as an example that is clear to all to explain why these are useful, not to mean that everthing you listed is related to iCloud. For instance secd and trustd are security subsystem daemon users. mdbulkimportd helps Spotlight run. To address everything you mentioned would take several chapters. Hopefully my answer will help you with an overall framework to examine these and learn more if you're curious. I do very much disagree with the summary of removing these accounts. You can't easily and if you succeed, you will break the system.
    – bmike
    Commented Dec 10, 2023 at 13:23
  • Thanks mike, I will read your answer in detail. I believe Andy 's proposal was to remove the useless account (my children account), not the processes, which as you say are essential.
    – Hugues
    Commented Dec 10, 2023 at 13:29
  • Aah yes - I misinterpreted the "unused accounts" part quite likely.
    – bmike
    Commented Dec 10, 2023 at 14:12
  • 1
    @bmike, yes I intended the accounts removal via the proper methods! Commented Dec 10, 2023 at 14:27
2

Yes - processes start before users log in.

macOS now launches some user processes before that user starts a graphical log in session. You're seeing that on macOS 12 for both system users and for the child users on your Mac (For instance each user spotlight processes start at system boot - not at user log in). Additionally, there are normal and expected users that can never log in graphically and you have listed some of those common users above.

Everything you describe is as intended and normal.

You can list the number of users on macOS systems as the root user:

sudo ls -1 /var/db/dslocal/nodes/Default/users | wc 

On my macOS 14 Mac - there are 122 users - my normal user which is the first one created when you set up your Mac, three other system users without a _ in front of the plist file (daemon, nobody and root) and the rest of the accounts start with a _. On 10.15 the count was 103 users with only one normal admin account.

If you're curious you can look at these files and see details about them, but they're binary files that need to be converted to text to see.


If you want to learn more about how (and when) each of these processes start - the most technical information is in Apple Developer documentation and some manual pages. However with macOS 13 the new service management has added authorizations, and the startup items may not be stores in the below locations - they are intended to exist within App bundles and self register calling API now.

man launchd.plist

At the bottom of the above preference list is this overall classification where you can start checking why things run and when they run and who chose to make them available to run. The launchd process orchestrates all of this.

FILES
~/Library/LaunchAgents Per-user agents provided by the user.
/Library/LaunchAgents Per-user agents provided by the administrator.
/Library/LaunchDaemons System-wide daemons provided by the administrator.
/System/Library/LaunchAgents Per-user agents provided by OS X.
/System/Library/LaunchDaemons System-wide daemons provided by OS X.

The new design is documented below (with a second link explaining the changes).

This old design was made to secure things by having helper users with enhanced permissions to do very specific tasks, but unable to do any other task was used to isolate our users from using or abusing the system resources. The new design has enhanced security as well but made things a bit more confusing.

1
  • 1
    Thanks bmike for pointing to me that processes can be launched for all users without graphic login, and changes documented in MacOS 13. FYI I'm still on 12.7.1. and never saw that earlier. So Apple did change things recently, likely retrofitting when upgrading the OS, and my 2 cents would be in 12.7
    – Hugues
    Commented Dec 10, 2023 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .