Warning: Endpoint has been activated through legacy launch(3) APIs

baobo5625 commented 9 years ago

Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.ReportCrash.DirectoryService

pops into sys log when creating a cisco ipsec vpn

baobo5625 commented 9 years ago

It only happens when i'm sudo ing the command

halo commented 9 years ago

Hi!

Is this just a warning or does it fail badly?
On which OS X version are you?
Also, without sudo I think nothing will happen at all, right? I mean, Mac OS won't create any VPN connections without superuser privileges as far as I know.

I haven't looked into this issue yet. (I've used XPC before but I'm not sure a helper tool makes sense for a command line tool at all... would have to dig in deeper there.)

halo commented 8 years ago

This can be reopened when it's more clear whether this actually is a problem or not.

lloydroc commented 7 years ago

FWIW I get this issue and don't even have Cisco Anyconnect on my machine.

lwee77 commented 6 years ago

Why do I get this message booting in osx recovery?

halo commented 6 years ago

@lwee77 Hi!

The error message you see is not specific to macosvpn in particular. I believe that error is displayed on macOS whenever a command is run with superuser privileges, without going through XPC (which is a way of communicating between processes).

I use XPC extensively in this GUI app because you don't want a GUI to have superuser privileges. Instead you talk via XPC to a small, separate executable (that has been authorized by the user) and that small executable has superuser privileges.

So it's basically a security concern and that's why it's deprecated to bypass XPC. However, in a command line tool such as macosvpn it makes sense to use the "deprecated" way, because it is an executable that is fired once and not a GUI application or a recurring process. It has been deprecated for years, but it is still perfectly valid to use it.

The error could be caused by any software on your system. Look at the prefix in the console to find out which one is causing it.

For example, if you see this:

(com.apple.quicklook[3854]): Endpoint has been activated...

then you know that Quicklook is the one causing it.

I assume that it is not macosvpn causing it when you boot into macOS recovery, because I see no reason why it should run there.

Let me know what you find out, maybe we can figure this out together.

lwee77 commented 6 years ago

Hi there, thank you for getting back to me... I show you what I see from my boot screen later when I get back

Get Outlook for Androidhttps://aka.ms/ghei36

From: halo notifications@github.com Sent: Saturday, August 11, 2018 2:25:37 PM To: halo/macosvpn Cc: lwee77; Mention Subject: Re: [halo/macosvpn] Warning: Endpoint has been activated through legacy launch(3) APIs (#10)

@lwee77https://github.com/lwee77 Hi!

The error message you see is not specifichttps://discussions.apple.com/thread/7814691 to macosvpn in particular. I believe that error is displayed on macOS whenever a command is run with superuser privileges, without going through XPC (which is a way of communicating between processes).

I use XPC extensively in this GUI apphttps://github.com/halo/LinkLiar/blob/95f423e16c20f16432934d81b9b6c4a7e33a7706/LinkHelper/Classes/LinkHelper.swift#L31 because you don't want a GUI to have superuser privileges. Instead you talk via XPC to a small, separate executable (that has been authorized by the user) and that small executable has superuser privileges.

So it's basically a security concern and that's why it's deprecated to bypass XPC. However, in a command line tool such as macosvpn it makes sense to use the "deprecated" way, because it is an executable that is fired once and not a GUI application or a recurring process. It has been deprecated for years, but it is still perfectly valid to use it.

The error could be caused by any softwarehttps://www.reddit.com/r/hackintosh/comments/8c5u6t/stuck_at_please_switch_to_xpc_or_bootstrap_check on your system. Look at the prefix in the console to find out which one is causing it.

For example, if you see this:

(com.apple.quicklook[3854]): Endpoint has been activated...

then you know that Quicklook is the one causing it.

I assume that it is not macosvpn causing it when you boot into macOS recovery, because I see no reason why it should run there.

Let me know what you find out, maybe we can figure this out together.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/halo/macosvpn/issues/10#issuecomment-412254949, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AILyL9l4yBJFm3z-r9VhR6_Qx3OIdFTuks5uPnjhgaJpZM4GCESw.

LadyViviann commented 5 years ago

@halo my macbookpro late 2013 running OSX 10.12.6 has this same message in the system log, but mine says: Jun 18, 2019, 10:45:12 PM com.apple.xpc.launchd[1]: Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook

I am trying to find a reason why my macbook keeps randomly restarting in the middle of things. It's not after a period of disuse, it's right in the middle of working and usually causes me to lose quite a bit of work. With the help of my IT buds I have tried, installing a fan control program, cleaning out the dust/fans, reinstalling various softwares, with no luck. This has been happening for about a year. The last time it happened was last night and the system log starts at 10:24 so maybe that time? I've attached it here. I really need to find out what's causing these restarts. The restart also logs me out of OSX, when regularly shutting down the computer does not. log for restart.txt

P.S. I found this thread by googling the error message, there is no help for this message on the apple forum... if you know a better place to ask this question, I'm happy to try elsewhere, really just grasping at straws at this point.

halo commented 5 years ago

Hi @LadyViviann, thank you for reporting that issue.

As you already have guessed, it has probably nothing to do with my software, but I'll see if I can assist you.

To begin with, the message "Endpoint has been activated through..." is merely a warning, not an error. The message and what it means is not problematic in itself.

It was good that you sent a log file, that helps. I guess you figured out how to capture that over the past year :D The crucial part in the log is probably this: Caller not allowed to perform action: loginwindow

There are other people who have the same error messages and more here and another one here and here. All with the same symptoms.

This one was particularly scary, because it was posted by (apparently) a security researcher with the title "MacBookPro13,3 Firmware Malware".

For what it's worth,

It could just be caused by an anti-virus program such as Symantec
It's possible you have a malware on your computer. Is there a way for you to reinstall the computer afresh?
the XPC warning you're seeing comes from com.apple.quicklook, that's when you press the space bar to quickly preview a file. Did you install a plugin for quicklook?
You have an awful lot of warnings by AdobeResourceSynchronizer, how about you uninstall that adobe software?
It could also just be a network drive error

So, enough googling for you today :) I hope you'll find the issue.

LadyViviann commented 5 years ago

Thanks! Lots to look into. Resetting my SMC stopped some background adobe task that generated a crash error. Interesting. And yes we have a quick look plug-in. Interesting. And yes I have, and run, Malwarebytes which says it’s clean. Thanks for your input and the suggestions! Very helpful. And yes, I know it’s not an error message. Lol. But it looks like something that’s not supposed to happen so 🤷🏼‍♀️ Thanks for your help!

Stamped with my iPhone

On Jun 20, 2019, at 11:09 AM, halo notifications@github.com wrote:

Hi @LadyViviann, thank you for reporting that issue.

As you already have guessed, it has probably nothing to do with my software, but I'll see if I can assist you.

To begin with, the message "Endpoint has been activated through..." is merely a warning, not an error. The message and what it means is not problematic in itself.

It was good that you sent a log file, that helps. I guess you figured out how to capture that over the past year :D The crucial part in the log is probably this: Caller not allowed to perform action: loginwindow

There are other people who have the same error messages and more here and another one here and here. All with the same symptoms.

This one was particularly scary, because it was posted by (apparently) a security researcher with the title "MacBookPro13,3 Firmware Malware".

For what it's worth,

It could just be caused by an anti-virus program such as Symantec It's possible you have a malware on your computer. Is there a way for you to reinstall the computer afresh? the XPC warning you're seeing comes from com.apple.quicklook, that's when you press the space bar to quickly preview a file. Did you install a plugin for quicklook? You have an awful lot of warnings by AdobeResourceSynchronizer, how about you uninstall that adobe software? It could also just be a network drive error So, enough googling for you today :) I hope you'll find the issue.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

halo / macosvpn

Warning: Endpoint has been activated through legacy launch(3) APIs #10