Silently updated security data files in Sequoia

Each of the main security services in macOS, such as XProtect, relies on data commonly stored in separate files on the Data volume so they can be updated directly outside full macOS system updates. Those are released silently by Apple, unannounced, and you aren’t even sent a notification when they’ve been updated.

Currently, those most frequently updated are XProtect and XProtect Remediator, normally released in two-week cycles. However, Sequoia has changed the way that XProtect’s data is updated, and it’s now intended occur over a connection to iCloud rather than through Software Update, while XProtect Remediator continues to rely on the latter rather than iCloud.

This article details each of the main security data files found in macOS 15 Sequoia, together with others involved in related system functions. Several other bundles that formerly had roles in security have now been emptied, or left frozen in time, and three have been removed completely; those are listed below for the record. As Apple doesn’t document any of them beyond mentioning their existence and simplified role, the information given is the best that I can find currently.

Main Security Data

XProtectPayloads, alias XProtect.app and XProtect Remediator
Latest version: 145, 3 September 2024.
This contains a suite of specialised malware detection and remediation tools, in the app bundle XProtect.app on the Data volume at /Library/Apple/System/Library/CoreServices. This was introduced in macOS 12.3, then version 62 was pushed to Catalina and later on 17 June 2022. Executables include a replacement for MRT, and many scanners for specific malware types. My free XProCheck inspects its reports for malware detection and remediation. This is normally updated every two weeks using Software Update or a substitute.

XProtectPlistConfigData
Latest version: 1.0 5273, 16 September 2024.
These are the whitelists and blacklists used by XProtect, as detailed here. In Sequoia, two different locations are used: the primary is at /var/protected/xprotect/XProtect.bundle, on the Data volume; the secondary is also on the Data volume at the traditional location of /Library/Apple/System/Library/CoreServices/XProtect.bundle, and is used as a fallback when there’s no bundle at the primary location. While previous versions of macOS still obtain updates through Software Update, Sequoia is intended to update the primary bundle via a CloudKit connection to iCloud, although it can still update the secondary bundle using those released via Software Update when they’re available. This is expected to be updated every two weeks, but may not be the same as updates for previous versions of macOS. You can force an update using the command sudo xprotect update in Terminal, and that will also copy an update obtained through Software Update to the primary location.

Bastion
Latest version: not given, but bundled in the current XProtectPayloads.
These provide rules and exceptions for XProtect Behaviour Service (XBS). First introduced in Ventura, this service monitors for and logs processes that access sensitive locations such as folders containing browser data. As of XProtectPayloads 137 it has 12 Bastion rules, but doesn’t block behaviours, only records them in its database at /var/protected/xprotect/XPdb. Bastion rules are defined in bastion.sb and BastionMeta.plist inside /Library/Apple/System/Library/CoreServices/XProtect.app Those are updated infrequently.

AppleKextExcludeList
Latest version: 20.0.0, 5 September 2024 (15.0 release).
This is a huge list of kernel extensions which are to be treated as exceptions to Sequoia’s security rules, and is stored on the Data volume in /Library/Apple/System/Library/Extensions/AppleKextExcludeList.kext, at Contents/Resources/ExceptionLists.plist.

Others

IncompatibleAppsList
Latest version: 140.191 (15.0 release).
This is a bundle on the Data volume at /Library/Apple/Library/Bundles/IncompatibleAppsList.bundle which contains IncompatibleAppsList.plist, listing many known incompatible versions of third-party products, including Flash Player.

Vestigial Data

MRTConfigData
Latest version: 1.93, 14 July 2022.
This was Apple’s Malware Removal Tool stored on the Data volume at Library/Apple/System/Library/CoreServices/MRT.app, so that it could remove any malware which macOS detected. This has now been replaced by the XProtectRemediatorMRTv3 executable module in XProtect Remediator, and may disappear in future versions of macOS. It usually isn’t installed as part of macOS, but may be later as a security data update.

Gatekeeper Configuration Data (GK Opaque)
Latest version: 181, but can instead be 94.
This is an SQLite database on the Data volume in /private/var/db/gkopaque.bundle/Contents/Resources/gkopaque.db may have been used to provide whitelists for Gatekeeper’s security system, which checks the code signatures of apps. Macs that have never had Catalina or earlier installed normally have the very old version 94, indicating this database is no longer used.

Gatekeeper E Configuration Data (GKE)
Latest version: 8.0.
This is an SQLite database on the Data volume in /private/var/db/gke.bundle/Contents/Resources/gk.db with an additional file gke.auth, which may have provided whitelists for Gatekeeper’s security system. gke.auth is believed to contain data for checking signed disk images, and seems to have remained largely unchanged since Sierra. gk.db was new in Catalina and hasn’t changed since.

Recently Removed

TCC_Compatibility Bundle
This used to be a bundle on the Data volume at /Library/Apple/Library/Bundles/TCC_Compatibility.bundle which has been removed from Sequoia.

Core Services Application Configuration Data
This used to be a bundle on the System volume at /System/Library/CoreServices/CoreTypes.bundle/Contents/Library/AppExceptions.bundle, containing a list of app exceptions in /System/Library/CoreServices/CoreTypes.bundle/Contents/Library/AppExceptions.bundle/Exceptions.plist. This has been removed from Sequoia.

CompatibilityNotificationData
This used to be a bundle on the Data volume at /Library/Apple/Library/Bundles/CompatibilityNotificationData.bundle, containing CompatibilityNotificationData.plist, and listing version ranges of third-party products to be notified as being (in)compatible. This has been removed from Sequoia.

Last updated: 24 September 2024.