Is it normal to have so many access denied errors due to sandbox for apple system processes?

I just did a clean install Ventur and am getting a lot of access denied errors reported for system processes. The clean install involved reformatting the entire internal SSD by choosing the device, not the volumes and then installing from a bootable USB, although I didn't actually boot from the USB, I just did it while I was in Recovery after reformatting the disk - but used the USB files (which I had just created using the create bootable installer tool in the Ventura 13.1 app itself).


Is this normal? The error rate is really fast, and at times the fault rate for various system processes is, as well. I'm concerned that either the Mac itself is a lemon, or Ventura is.


I should point out that this is a MacBook Pro 14" 18,4 - the 10 cpu/24 gpu M1, with 64 gb memory and a 2 TB drive.

I have had various problems - it's now been 48 hours since the install and the battery isn't using optimal charging yet, as it should be by now. I think it is turned on - at least system settings says it is, but cfprefsd is one of the process getting sandbox errors when trying to read my preferences and at least in the case of Allow Remote Access, I had to toggle the switch a couple of times before sshd actually ran. Changing the computer name also seemed to take a while to display correctly, I had to keep changing it back to my desired name because it would revert to the default name. I'm not sure if the Systems Setting is displaying the actual state of various options because of that.


This is a MacBook Pro 18,4, with the 10 cpu/24 gpu M1, 64 gb memory and a 2 TB drive.



MacBook Pro 14″

Posted on Dec 29, 2022 8:05 PM

Reply
Question marked as Top-ranking reply

Posted on Jan 2, 2023 2:51 PM

I did a DFU restore yesterday, which offered me Ventura 13.1, so I installed it. I may try again with a different ipsw file to get it back to Monterey, Ventura 13.1 still has problems with System Settings not sticking the first time. From the point of view of the GUI, it appears that most things are operating as expected, though I'm having some problems editing this message (copy and pasted text disappears, beachballs occasionally and keystrokes arriving out of order).


It hasn't made a difference, in fact, I seem to be getting more errors.


Still have lots of Sandbox errors, though when I put some of those programs in "allow full disk access", I started getting errors that they are duplicates of other sandbox accesses granted, and, at times, messages to the effect of "why does this program have access to this" messages. It's hard to tell if it's by design or if it's an actual problem. Perhaps I'm just seeing the initial error message, and the system attempts to give it sandbox permissions after that, but I don't think most are successful, but it's hard to tell without some deep log analysis by me.


I've noticed that a lot of these errors are actually "To Do" messages to remind Apple developers of what still needs to be done, or simply checkpoints for following a process' process. More like "Info" messages than "Error" messages. But I still get more than a few "Fault" messages, and a lot of these errors cause actual problems in the desktop environment, i.e. the problem reaches the GUI and the errors are affecting Apple default programs like Safari.


Particularly concerning to me are the

 45001 wakeups over the last 153 seconds (293 wakeups per second average), exceeding limit of 150 wakeups per second over 300 seconds 

that a few processes are causing.


I get a lot of these types of messages, as well.


fault	15:13:20.299185-0600	com.apple.Safari.History	Couldn't read values in CFPrefsPlistSource<0x600003dc0980> (Domain: kCFPreferencesAnyApplication, User: kCFPreferencesAnyUser, ByHost: Yes, Container: (null), Contents Need Refresh: Yes): accessing these preferences requires user-preference-read or file-read-data sandbox access


followed by

error    15:13:20.310324-0600	cfprefsd	rejecting read of { kCFPreferencesAnyApplication, bob, kCFPreferencesCurrentHost, /Users/bob/Library/Preferences/ByHost/.GlobalPreferences.1C8F38D1-F980-525A-B115-5E18C3B3A296.plist, managed: 0 } from process 503 (com.apple.Safari.History) because accessing these preferences requires user-preference-read or file-read-data sandbox access.   

so I believe cfprefsd is having difficulty reading preferences, and that's where the majority of my problems are coming from. I get a lot of these

error	16:20:20.026809-0600	cfprefsd	Couldn't open parent path due to [2: No such file or directory]

but, that may just a message that cfprefsd has exited a read prefs loop by reaching the end of it, I can't tell, but when I add cfprefsd to "allow full disk access", I get these errors:

error	16:29:59.235518-0600	kernel	Sandbox: analyticsd(166) deny(1) file-issue-extension target:/private/var/db/analyticsd/Library/Preferences/analyticsd.plist class:com.apple.cfprefsd.read-write

so maybe it shouldn't be there, in any event other systems are telling cfprefsd that it can't do something, regardless of what I granted it.


It gets worse once iCloud is involved, Family can't get what it asks for:

error	16:18:08.326345-0600	Family	Unable to open XPC store: Error Domain=NSCocoaErrorDomain Code=134060 "A Core Data error occurred." UserInfo={Problem=Unable to send to server; failed after 8 attempts.} {
    Problem = "Unable to send to server; failed after 8 attempts.";
}



The logs are also rolling over very quickly, due to all the messages.


Personally, I think it's Ventura 13.1 - there's no excuse to release this update in this condition. My system passes diagnostics, it's a clean install: "erased contents and settings", put it into DFU mode and restored (not revived) the DFU successfully, installed 13.1 when the system started the "Hello" screens, and yet I still have all these errors and faults.


But, considering all System Settings that don't stick occasionally, I'm going to punt and install Monterey on here. I'll wait until Ventura is ready for primetime before I'll install it.


It would be interesting to know whether other users of 13.1 get the same types of errors.

Similar questions

7 replies
Question marked as Top-ranking reply

Jan 2, 2023 2:51 PM in response to James Brickley

I did a DFU restore yesterday, which offered me Ventura 13.1, so I installed it. I may try again with a different ipsw file to get it back to Monterey, Ventura 13.1 still has problems with System Settings not sticking the first time. From the point of view of the GUI, it appears that most things are operating as expected, though I'm having some problems editing this message (copy and pasted text disappears, beachballs occasionally and keystrokes arriving out of order).


It hasn't made a difference, in fact, I seem to be getting more errors.


Still have lots of Sandbox errors, though when I put some of those programs in "allow full disk access", I started getting errors that they are duplicates of other sandbox accesses granted, and, at times, messages to the effect of "why does this program have access to this" messages. It's hard to tell if it's by design or if it's an actual problem. Perhaps I'm just seeing the initial error message, and the system attempts to give it sandbox permissions after that, but I don't think most are successful, but it's hard to tell without some deep log analysis by me.


I've noticed that a lot of these errors are actually "To Do" messages to remind Apple developers of what still needs to be done, or simply checkpoints for following a process' process. More like "Info" messages than "Error" messages. But I still get more than a few "Fault" messages, and a lot of these errors cause actual problems in the desktop environment, i.e. the problem reaches the GUI and the errors are affecting Apple default programs like Safari.


Particularly concerning to me are the

 45001 wakeups over the last 153 seconds (293 wakeups per second average), exceeding limit of 150 wakeups per second over 300 seconds 

that a few processes are causing.


I get a lot of these types of messages, as well.


fault	15:13:20.299185-0600	com.apple.Safari.History	Couldn't read values in CFPrefsPlistSource<0x600003dc0980> (Domain: kCFPreferencesAnyApplication, User: kCFPreferencesAnyUser, ByHost: Yes, Container: (null), Contents Need Refresh: Yes): accessing these preferences requires user-preference-read or file-read-data sandbox access


followed by

error    15:13:20.310324-0600	cfprefsd	rejecting read of { kCFPreferencesAnyApplication, bob, kCFPreferencesCurrentHost, /Users/bob/Library/Preferences/ByHost/.GlobalPreferences.1C8F38D1-F980-525A-B115-5E18C3B3A296.plist, managed: 0 } from process 503 (com.apple.Safari.History) because accessing these preferences requires user-preference-read or file-read-data sandbox access.   

so I believe cfprefsd is having difficulty reading preferences, and that's where the majority of my problems are coming from. I get a lot of these

error	16:20:20.026809-0600	cfprefsd	Couldn't open parent path due to [2: No such file or directory]

but, that may just a message that cfprefsd has exited a read prefs loop by reaching the end of it, I can't tell, but when I add cfprefsd to "allow full disk access", I get these errors:

error	16:29:59.235518-0600	kernel	Sandbox: analyticsd(166) deny(1) file-issue-extension target:/private/var/db/analyticsd/Library/Preferences/analyticsd.plist class:com.apple.cfprefsd.read-write

so maybe it shouldn't be there, in any event other systems are telling cfprefsd that it can't do something, regardless of what I granted it.


It gets worse once iCloud is involved, Family can't get what it asks for:

error	16:18:08.326345-0600	Family	Unable to open XPC store: Error Domain=NSCocoaErrorDomain Code=134060 "A Core Data error occurred." UserInfo={Problem=Unable to send to server; failed after 8 attempts.} {
    Problem = "Unable to send to server; failed after 8 attempts.";
}



The logs are also rolling over very quickly, due to all the messages.


Personally, I think it's Ventura 13.1 - there's no excuse to release this update in this condition. My system passes diagnostics, it's a clean install: "erased contents and settings", put it into DFU mode and restored (not revived) the DFU successfully, installed 13.1 when the system started the "Hello" screens, and yet I still have all these errors and faults.


But, considering all System Settings that don't stick occasionally, I'm going to punt and install Monterey on here. I'll wait until Ventura is ready for primetime before I'll install it.


It would be interesting to know whether other users of 13.1 get the same types of errors.

Dec 29, 2022 9:35 PM in response to Phlac

Oh my... I have some bad news for you...


Apple Silicon Macs (M1 / M2) cannot be clean installed in the traditional sense of booting from USB and completely erasing the internal SSD then re-installing the OS. It's a good thing you didn't reboot from recovery mode or you would be completely bricked.


I would recommend the following. Take it to an Apple Store Genius Bar or find someone with another Mac even an Intel one. Install Apple Configurator 2 from the Mac App Store on the second Mac. Then obtain a USB-C Thunderbolt cable. You need to put the M1 Mac into DFU mode where it powers up with a black screen but it is detected by the second Mac in Apple Configurator. Then you can tell Apple Configurator to fully restore macOS on the M1 Mac. It will download macOS Ventura and it will install it from scratch on the M1 Mac replacing the protected hidden partitions and the immutable read-only system volume / APFS snapshot. This is how a full clean install is performed with Apple Silicon.


It will likely take several attempts before you get the M1 Mac into DFU mode, be patient

Revive or restore a Mac with Apple silicon using Apple Configurator - Apple Support


In future, the right way to do it is to Erase All Settings and Content which only works on Apple Silicon based Macs. System Settings -> General -> Transfer or Reset -> Erase All Content and Settings. It works exactly like reseting an iPhone to factory settings. The DFU restoration process for an iPhone is also the same.


Jan 2, 2023 3:00 PM in response to Phlac

Most people are never going to look at the logs, you can safely ignore them.


The Unified Log is amazingly complex and overwhelming. Most of the errors in the Unified Log are white noise. Many debug messages and errors that may not be a real problem. Definitely meant for internal Apple developers. You are never ever going to clear all the errors and warnings because the OS is logging everything in great detail practically at a debugging level of detail.


But if you wish to learn more about unified logging this blog is exceptional:

https://eclecticlight.co/?s=Unified+Log


The author has some interesting log query tools to filter out just what you need when you need it. You can do much of this from the Terminal and he has articles that discuss it. But it's far from easy. His GUI tools provide a much nicer way of pulling meaningful data from the logs. But it's a steep learning curve to wrap your head around what's going on.


Dec 30, 2022 3:52 PM in response to James Brickley

Thank you for your response


No, my DFU is fine, it boots into Normal mode and passes all the steps of a normal boot.


I'm sorry I wasn't very clear in my initial post, I created the USB install like this: Create a bootable installer for macOS - Apple Support did Erase your Mac and reset it to factory settings - Apple Support and then Use Disk Utility to erase a Mac with Apple silicon - Apple Support rebooted into Recovery mode and chose the Ventura install on the USB stick. The other choice was to continue and install Monterey.


I'm wondering, if by logging into iCloud, I brought back garbage or something?


I'll try another clean install and let it load the Monterey package instead, just to see if the system is sane, and then try the Ventura 3.1 install after that.


Dec 30, 2022 11:11 PM in response to James Brickley

Oh! Perhaps you’re right. I did a standard Erase Contents and Settings and let it reinstall today and still had a problem getting the computer name to propagate, as well as network settings for connections not saving some preferences on the first try. Also, still getting a lot of sandbox related access denied errors in the log. I’ll reinstall the DFU tomorrow and see if it helps.


Thanks!

Jan 2, 2023 7:52 PM in response to James Brickley

While I agree that I could ignore the logs, it doesn’t rectify my problem with System Settings not behaving well. A quick look at other posts indicates that the System Settings not sticking problem is prevalent. I would guess less than one in a thousand users post here about any particular problem, and this issue is getting mentioned often. I would consider it widespread at this point.


I am a fan of eclecticlight.co, as well. Very good site and it was a very good tip, thanks.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Is it normal to have so many access denied errors due to sandbox for apple system processes?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.