syspolicyd

executablemacOS2.5 MBx86_64, arm64

System enrollment and device management — handles MDM profile installation and device authentication

Manages device enrollment in mobile device management systems and installs MDM configuration profiles with system-level access. Authenticates users via Touch ID, Face ID, or password through Keychain and certificate validation. Synchronizes iCloud data and submits wireless diagnostics and unified analytics to Apple infrastructure. Directly communicates with hardware through drivers, reads and writes NVRAM variables, and verifies code signatures. Operates through 13 XPC services exposing management capabilities to other system components.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 2.5 MB
UUID: 8248996F-6AE5-3C31-9B99-E4157C98C491
Analyzed: 2026-04-09T10:07:48Z
CDHash: ac5a430b1db4636ecdceaa4bce8be2699d1ec009ab94d1843df695c69bd74182

Capabilities

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

NetworkiCloud data sync

/System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit

StorageRead and write system NVRAM variables

com.apple.private.iokit.system-nvram-allow [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.MobileIdentityService [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.SystemPolicyConfiguration [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.appinstalld [object Object]

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

IpcProtocol buffer serialization

/System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBuffer

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

AnalyticsWireless diagnostic reporting

/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/WirelessDiagnostics

SecurityTouch ID / Face ID / password auth

/System/Library/Frameworks/LocalAuthentication.framework/Versions/A/LocalAuthentication

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SecurityCryptographic operations

/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKit

SystemAccess MDM configuration profiles

com.apple.private.managedclient.configurationprofiles [object Object]

SystemMDM configuration profiles

/System/Library/PrivateFrameworks/ConfigurationProfiles.framework/Versions/A/ConfigurationProfiles

Frameworks59

CloudTelemetry libEndpointSecuritySystem.dylib libbz2.1.0.dylib liblzma.5.dylib libz.1.dylib libpartition2_dynamic.dylib libMobileGestalt.dylib(weak)libmis.dylib libbootpolicy.dylib LocalAuthentication CoreAnalytics SystemConfiguration libsandbox.1.dylib yara libbsm.0.dylib TCC CoreFoundation libxar.1.dylib PackageKit SystemPolicy ConfigurationProfiles CoreServices KernelManagement IOKit Bootability OpenDirectory ProtocolBuffer Security SoftLinking XprotectFramework WirelessDiagnostics libDiagnosticMessagesClient.dylib libsqlite3.dylib Foundation libobjc.A.dylib libc++.1.dylib libSystem.B.dylib CloudKit CryptoKit OSAnalytics SoftwareUpdate libswiftAppleArchive.dylib libswiftCompression.dylib(weak)libswiftCore.dylib libswiftCoreFoundation.dylib(weak)libswiftCoreImage.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib libswiftQuartzCore.dylib(weak)libswiftSystem.dylib libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswiftos.dylib libswiftsimd.dylib(weak)

Entitlements41

com.apple.application-identifier com.apple.syspolicyd.spTest

com.apple.developer.icloud-services

com.apple.keystore.filevaulttrue

com.apple.private.CoreAuthentication.SPItrue

com.apple.private.IASInstallerAuthAgenttrue

com.apple.private.LocalAuthentication.CallerNametrue

com.apple.private.appleaccount.app-hidden-from-icloud-settingstrue

com.apple.private.applecredentialmanager.allowtrue

com.apple.private.bootabilitytrue

com.apple.private.cloudkit.masqueradetrue

com.apple.private.cloudkit.setEnvironmenttrue

com.apple.private.cloudkit.systemLaunchDaemonAccesstrue

com.apple.private.cloudkit.systemServicetrue

com.apple.private.cloudtelemetrytrue

com.apple.private.endpoint-security.submit.gatekeepertrue

com.apple.private.endpoint-security.submit.xptrue

com.apple.private.iokit.nvram-panicmedictrue

com.apple.private.iokit.system-nvram-allowtrue

com.apple.private.managedclient.configurationprofilestrue

com.apple.private.quarantine.controltrue

com.apple.private.security.appbundle-authoritytrue

com.apple.private.security.bootpolicytrue

com.apple.private.security.register-xprotect-profiletrue

com.apple.private.security.storage.MobileIdentityServicetrue

com.apple.private.security.storage.SystemPolicyConfigurationtrue

com.apple.private.security.storage.appinstalldtrue

com.apple.private.syspolicy.gatekeeper.settings-managementtrue

com.apple.private.syspolicy.perform-evaluationstrue

com.apple.private.tcc.allow

kTCCServiceLiverpool kTCCServiceSystemPolicyAllFiles

com.apple.private.tcc.external.reporttrue

com.apple.private.tcc.manager.access.modify

kTCCServiceDeveloperTool

com.apple.private.tcc.manager.access.read

com.apple.private.tcc.manager.check-by-audit-token

kTCCServiceDeveloperTool

com.apple.private.xprotecttrue

com.apple.private.xprotect.behavior-submittrue

com.apple.rootless.restricted-nvram-variablestrue

com.apple.rootless.storage.SystemPolicyConfigurationtrue

com.apple.rootless.volume.Preboottrue

com.apple.rootless.volume.Recoverytrue

com.apple.rootless.volume.iSCPreboottrue

com.apple.rootless.volume.iSCRecoverytrue

Interesting Strings

Bundle IDs(252)

(literal "${ANY_USER_HOME}/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"))) (system-binary "com.apple.Finder") (system-binary "com.apple.IMAutomaticHistoryDeletionAgent") (system-binary "com.apple.MRT") (system-binary "com.apple.MobileSMS")

File Paths(100)

(literal "${ANY_USER_HOME}/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"))) (regex #"^/Library/PrivilegedHelperTools/\."))) (subpath "${ANY_USER_HOME}/Library/Application Support/Firefox/Profiles/")) (subpath "${ANY_USER_HOME}/Library/Application Support/Google/Chrome/Default/")) (subpath "${ANY_USER_HOME}/Library/Application Support/Microsoft/Teams/"))

telemetry(61)

com.apple.private.cloudtelemetry *com.apple.private.xprotect.behavior-submit -com.apple.private.endpoint-security.submit.xp /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics /System/Library/PrivateFrameworks/OSAnalytics.framework/Versions/A/OSAnalytics

URLs & Endpoints(6)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://api.apple-cloudkit.com/database/1/%@/%@/public/records/lookup

Network Surface

Networking Frameworks

CoreFoundation Foundation libswiftCoreFoundation.dylib

Endpoints(51)

Hostnamesyspolicyd-726.40.17

Hostnamesyspolicyd.exec.policy-completion

Hostnamefield.1.2.840.113635.100.6.1.9

Hostnamefield.1.2.840.113635.100.6.2.1

Hostnamefield.1.2.840.113635.100.6.1.25.1

Urlhttps://api.apple-cloudkit.com/database/1/%@/%@/public/records/lookup

Hostnameapi.apple-cloudkit.com

Hostnamefield.1.2.840.113635.100.6.2.6

Hostnamefield.1.2.840.113635.100.6.1.13

Hostnametimestamp.1.2.840.113635.100.6.1.33

Hostnamefield.1.2.840.113635.100.6.1.9.1

Hostnamefield.1.2.840.113635.100.6.1.25.2

Hostnamejp.co

Hostnamekr.co

Hostnameuk.co

Hostnamenz.co

Hostnamekr.org

Hostnamecn.com

Hostnametw.com

Hostnameau.com

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

Methods

+[CKTicketStore cleanupAssetURL:]-[AKELData initWithURL:]-[BastionBundle initWithURL:withStagedURL:]-[BundleData initWithURL:withReloadBlock:watchForUpdates:]-[GKEBundle initWithURL:withStagedURL:]-[KextClassifier initWithURL:]-[KextTarget initWithURL:withAKELData:]-[OSKextProperties initWithURL:]-[PackagePolicyScanTarget initWithURL:]-[PolicyScanTarget initWithURL:]-[StagedBundleData initWithURL:withStagedURL:withReloadBlock:withPrepareBlock:]-[XPBundle initWithURL:withStagedURL:withNewBundleStructure:]-[YaraScanJob initWithURL:withMinScanTime:completionHandler:]

DNA Capability Vector

Location

0

Keychain

0

Network

2

Storage

4

Hardware

1

IPC

1

Analytics

2

Security

3

System

2

Behavioral Profile

URL Endpoints

6

Telemetry Strings

61

File Paths

100

Bundle IDs

252

IOKit Constants

0

Library Functions

2

Structural HashesSHA-256

Code1c0a62bcae2370ed35a180260cf10d47c533888ab2107c412a29b2201b0844a6

Importsfd530049c5b4249b37e94f8f37391cda19c237a39cf9848e3065fdedc90ee61b

Frameworkse5cfc12565945622caa0667694267e61134f4769f9364a9697c3ef4b27b1ef1f

Classes699ce3c6945f6006f8bcf5a9fb84b5b588c9fce63f6e0377b28c063807105bc4

Entitlements9e71e81d107969dd3fbf5843010ebedc3276f8c06e6e12afe62a04e4f2c0b5f2

Symbolsec5883437743e5cd3ef0213bddeb02d95301398ab691a73678b881c5e2ac57dd

Static Libraries2 / 3460 functions identified

Identified Libraries

flatbuffers 25.9.23 (2 fn)

Functions(3460)

0x100002528+[SPSamplingTasking supportsSecureCoding]

0x100002530-[SPSamplingTasking initWithCoder:]

0x1000026ac-[SPSamplingTasking encodeWithCoder:]

0x100002758-[SPSamplingTasking redactedDescription]

0x10000275c-[SPSamplingTasking description]

0x1000027a4-[SPSamplingTasking uuid]

0x1000027ac-[SPSamplingTasking setUuid:]

0x1000027b8-[SPSamplingTasking name]

0x1000027c0-[SPSamplingTasking setName:]

0x1000027cc-[SPSamplingTasking expiration]

0x1000027d4-[SPSamplingTasking setExpiration:]

0x1000027e0-[SPSamplingTasking samplingRate]

0x1000027e8-[SPSamplingTasking setSamplingRate:]

0x1000027f4-[SPSamplingTasking publicKey]

0x1000027fc-[SPSamplingTasking setPublicKey:]

0x100002808-[SPSamplingTasking .cxx_destruct]

0x100002870sub_100002870

0x1000028d8-[PackagePolicyScanTarget initWithURL:]

0x1000029bc-[PackagePolicyScanTarget cdhash]

0x100002a4c-[PackagePolicyScanTarget cdhashData]

Imports1008 symbols from 44 dylibs

libSystem.B.dylib288 libswiftCore.dylib142 CoreFoundation111 Foundation92 Security71

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

backgroundassets.user

mobileactivationd

online-auth-agent