Blocked Internet access to MacOS daemons & agents

Privacy
1

Here is a list of some MacOS daemons and agents which have been trying to access the internet, and which I have now blocked in my firewall.

Many of the services were trying to access the internet, even when the respective app was not in use, and even when the services were explicitly disabled in System preferences. for eg. Stocks, News, Weather, Notes, iCloud, iTunes, Wallet, Home Kit, No ad preserving measurement required, etc.

Some of these daemons are for support for connected iOS devices. I don’t use iPhone/iPad so they were irrelevant for me.

Do comment if

  • you believe some of these services are critical and should be allowed Internet access.
  • Have clarity on the purpose of each or any of these daemons? Very limited information is available on Internet.
  • Have you ever monitored on your Macs, how many Apple services randomly and regularly connect home? and what data do they share back?

Try the Lulu firewall or Little Snitch. Uncheck Allow Apple Programs, Uncheck Allow Installed Programs. This will give you a fair idea of the services which try to access the internet from the moment you log in.

My Mac still works fine. No critical functionality seems to be affected, yet.

adprivacyd
com.apple.ap.adprivacyd
/usr/libexec/adprivacyd

AMPLibraryAgent
com.apple.AMPLibraryAgent
/System/Library/PrivateFrameworks/AMPLibrary.framework/Versions/A/Support/AMPLibraryAgent

amsaccountsd
com.apple.amsaccountsd
/System/Library/PrivateFrameworks/AppleMediaServices.framework/Versions/A/Resources/amsaccountsd

amsengagementd
com.apple.amsengagementd
/System/Library/PrivateFrameworks/AppleMediaServicesUI.framework/amsengagementd

appstoreagent
com.apple.appstoreagent
/System/Library/PrivateFrameworks/AppStoreDaemon.framework/Support/appstoreagent
Edit: Allowed permission to access the internet.

askpermissiond
com.apple.askpermissiond
/System/Library/PrivateFrameworks/AskPermission.framework/Versions/A/Resources/askpermissiond

cloudd
com.apple.cloudd
/System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd

FindMyWidgetIntentsPeople
com.apple.findmy.FindMyWidgetIntentsPeople
/System/Applications/FindMy.app/Contents/PlugIns/FindMyWidgetIntentsPeople.appex

homed
com.apple.homed
/System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed

iCloudNotificationAgent
com.apple.iCloudNotificationAgent
/System/Library/PrivateFrameworks/iCloudNotification.framework/iCloudNotificationAgent

itunescloudd
com.apple.itunescloudd
/System/Library/PrivateFrameworks/iTunesCloud.framework/Support/itunescloudd

NewsTag
com.apple.news.tag
/System/Applications/News.app/Contents/PlugIns/NewsTag.appex

NewsToday2
com.apple.news.widget
/System/Applications/News.app/Contents/PlugIns/NewsToday2.appex

Notes
com.apple.Notes
/System/Applications/Notes.app/Contents/MacOS/Notes

parsec-fbf
com.apple.parsec-fbf
/System/Library/PrivateFrameworks/CoreParsec.framework/parsec-fbf

parsecd
com.apple.parsecd
/System/Library/PrivateFrameworks/CoreParsec.framework/parsecd

passd
com.apple.passd
/System/Library/PrivateFrameworks/PassKitCore.framework/passd

PasswordBreachAgent
Com.apple.Safari.PasswordBreachAgent
/System/Volumes/Preboot/Cryptexes/App/usr/libexec/PasswordBreachAgent

promotedcontentd
Com.apple.ap.promotedcontentd
/usr/libexec/promotedcontentd

searchpartyuseragent
com.apple.icloud.searchpartyuseragent
/usr/libexec/searchpartyuseragent

Spotlight
com.apple.Spotlight
/System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight

StocksDetailIntents
com.apple.StocksDetailIntents
/System/Applications/Stocks.app/Contents/PlugIns/StocksDetailIntents.appex

StocksWidget
com.apple.stocks,widget
/System/Applications/Stocks.app/Contents/PlugIns/StocksWidget.appex

tipsd
com.apple.tipsd
/usr/libexec/tipsd

triald
com.apple.triald
/usr/libexec/triald

Wallet & Apple Pay
com.apple.WalletSettingsExtension
/System/Library/ExtensionKit/Extensions/WalletSettingsExtension.appex

weatherd
com.apple.weatherd
/System/Library/PrivateFrameworks/WeatherDaemon.framework/weatherd

WeatherWidget
com.apple.weather.widget
/System/Applications/Weather.app/Contents/PlugIns/WeatherWidget.appex

2 Likes
2

These are some of the daemons & agents which currently do have access to the internet, and I am not sure on the purpose of some of them to connect to the Internet.

Do share, if you have any info on these, their purpose or whether they can be safely blocked from accessing the Internet.

airportd
akd
apsd
appstoreagent ← Edit: Added this here
AssetCacheLocatorService
captiveagent
com.apple.geod
configd
ControlCenter
familycircled
helpd
identityservicesd
mDNSresponder
mobileassetd
ndoagent
netbiosd
networkserviceproxy
nsurlsessionid
ocspd
passd
plugin-container.app
rtcreportingd
sntp
softwareupdated
studentd
syspolicyd
taskgated-helper
timed
trustd
WifiAgent

3

Won’t blocking appstoreagent stop you from getting automatic updates for your App Store apps?

2 Likes
4

u r right, fixed it.

5

Insight on a few of the processes you’re not sure about:

  • captiveagent detects captive portals on wi-fi networks so they can be properly accessed and logged into.
  • apsd is for push notifications.
  • trustd verifies the validity of digital certificates.
  • mDNSresponder is necessary for local discovery features like AirDrop, I believe.

I have had the following blocked for over a year with no issues:

  • AssetCacheLocatorService
  • helpd
  • studentd
2 Likes
6

It sounds like you may have widgets for those apps in Notification Centre. Spotlight can also retrieve information from those services and can be disable in system settings.
Currently, there is no explicit way to remove native apps in macOS.

It might be because you have AirDrop or Handoff. You can disable AirDrop and Handoff in system settings.

7

I thought Apple had the ability to bypass all these shenanigans in MacOS or was it just iOS?

1 Like