Sostanzialmente ciò che dice il titolo. Di recente ho dato un'occhiata al mio /var/log/install.log e le prime voci risalgono a circa 2 mesi interi prima che unboxing il computer.
La confezione conteneva cellophane, nessuna indicazione era di seconda mano, e nulla sembrava affatto normale. Tutto era nuovo, l'ho aperto e ho passato una tipica installazione di OSX.
Questo era più di 2 anni fa.
Questo è il file install.log da 2 mesi prima dell'annullamento iniziale:
MacBook-Pro Language Chooser[178]: LCA+BT2: BT host controller appeared after 2 seconds
MacBook-Pro Language Chooser[178]: ISAP: Done with phase “Language Chooser”
MacBook-Pro SetupAssistantSpringboard[203]: Starting SetupAssistantSpringboard for user 0...
MacBook-Pro mbsystemadministration[204]: Starting MBSystemAdministration...
MacBook-Pro mbsystemadministration[204]: Adding client connection <NSXPCConnection: 0x7fbd6b601330> connection from pid 203
MacBook-Pro mbsystemadministration[204]: RamDisk created at /dev/disk2
MacBook-Pro mbsystemadministration[204]: newfs_hfs: Initialized /dev/rdisk2 as a 49 MB case-insensitive HFS Plus volume
MacBook-Pro mbsystemadministration[204]: mount:
MacBook-Pro mbsystemadministration[204]: chown:
MacBook-Pro mbsystemadministration[204]: MBSetupUser: createHomeDirectory succeeded
MacBook-Pro mbsystemadministration[204]: Commit user changes: 0
MacBook-Pro mbsystemadministration[204]: Creating background user agent for uid 248
MacBook-Pro mbsystemadministration[204]: Created preferences directory at /var/setup/Library/Preferences
MacBook-Pro mbsystemadministration[204]: Copied preference file .GlobalPreferences.plist
MacBook-Pro mbsystemadministration[204]: MBSetupUser: Wrote setup user dictionary
MacBook-Pro mbbackgrounduseragent[218]: Starting MBBackgroundUserAgent...
MacBook-Pro mbbackgrounduseragent[218]: Adding client connection <NSXPCConnection: 0x7fadf96078e0> connection from pid 204
MacBook-Pro mbsystemadministration[204]: MBSetupUser: disable screenlock succeeded
MacBook-Pro mbsystemadministration[204]: Setting one-time autologin user _mbsetupuser
MacBook-Pro mbsystemadministration[204]: Commit user changes: 0
MacBook-Pro mbsystemadministration[204]: CGSSessionCopyAllSessionProperties:(
{
kCGSSessionAuditIDKey = 100007;
kCGSSessionGroupIDKey = 80;
kCGSSessionIDKey = 257;
kCGSSessionLoginwindowSafeLogin = 0;
kCGSSessionOnConsoleKey = 1;
kCGSSessionSystemSafeBoot = 0;
kCGSSessionUserIDKey = 0;
kCGSSessionUserNameKey = root;
kCGSessionLoginDoneKey = 0;
kCGSessionLongUserNameKey = "System Administrator";
kSCSecuritySessionID = 100007;
}
)
MacBook-Pro SetupAssistantSpringboard[203]: Exiting successfully
MacBook-Pro mbsystemadministration[204]: Removing client connection <NSXPCConnection: 0x7fbd6b601330> connection from pid 203
MacBook-Pro loginwindow[71]: IASGetCurrentInstallPhaseList: no install phase array set
MacBook-Pro loginwindow[71]: IASGetCurrentInstallPhase: no install phase set
MacBook-Pro Setup Assistant[229]: Starting Setup Assistant with uid 248…
MacBook-Pro mbsystemadministration[204]: Adding client connection <NSXPCConnection: 0x7fbd6b428670> connection from pid 229
MacBook-Pro mbsystemadministration[204]: Restoring autologin user (null)
MacBook-Pro Setup Assistant[229]: Running as MacBuddy
MacBook-Pro mbsystemadministration[204]: Commit user changes: 0
MacBook-Pro mbsystemadministration[204]: couldn't get language ordering from file
MacBook-Pro mbsystemadministration[204]: There is [NO] existing Kerberos realm, running configureLocalKDC.
MacBook-Pro mbsystemadministration[204]: configureLocalKDC:
MacBook-Pro mbsystemadministration[204]: certtool systemdefault:...System identity already exists for domain com.apple.systemdefault. Done.
MacBook-Pro Setup Assistant[229]: MBSA pre MacBuddy tasks: SUCESS
MacBook-Pro Setup Assistant[229]: --- MBCopyNetworkConfig ---
MacBook-Pro Setup Assistant[229]: IP: (null)
MacBook-Pro Setup Assistant[229]: Mask: (null)
MacBook-Pro Setup Assistant[229]: Router: (null)
MacBook-Pro Setup Assistant[229]: Domain: (null)
MacBook-Pro Setup Assistant[229]: Config Method: (null)
MacBook-Pro Setup Assistant[229]: NetworkingManager: Listening for reachability information.
MacBook-Pro Setup Assistant[229]: NetworkingManager: Network unreachable: catch-all case.
MacBook-Pro Setup Assistant[229]: CloudConfigurationManager: Network unreachable. Waiting to trigger ManagedClient request.
MacBook-Pro Setup Assistant[229]: CloudConfigurationManager: Can't cancel nonexistent activation request: (null)
MacBook-Pro systemmigrationd[268]: systemmigrationd: Starting
MacBook-Pro storagekitd[271]: Starting SKDaemon...
MacBook-Pro storagekitd[271]: Client entitled for destructive operations
MacBook-Pro storagekitd[271]: Adding client connection <NSXPCConnection: 0x7feaabe01300> connection from pid 268
MacBook-Pro installd[277]: installd: Starting
MacBook-Pro installd[277]: installd: uid=0, euid=0
MacBook-Pro systemmigrationd[268]: Connected to daemon. Language set to: English
MacBook-Pro systemmigrationd[268]: systemmigrationd: New connection for System Selection
MacBook-Pro systemmigrationd[268]: systemmigrationd: New connection for Progress
MacBook-Pro systemmigrationd[268]: systemmigrationd: Adding client <SMDProgress_XPCClientConnection: 0x7f9d33d49cb0>
MacBook-Pro systemmigrationd[268]: systemmigrationd: Adding client <SMDSystemScanner_XPCClientConnection: 0x7f9d33d4a100>
MacBook-Pro systemmigrationd[268]: Inform Remote Client of new System A63B3DED-C9E5-41A0-A25F-0D1E2B004506
MacBook-Pro systemmigrationd[268]: systemmigrationd: New connection for Progress
MacBook-Pro systemmigrationd[268]: systemmigrationd: Adding client <SMDProgress_XPCClientConnection: 0x7f9d33d4a790>
MacBook-Pro Setup Assistant[229]: Current Language=en, 10 countries found. 228 known
MacBook-Pro Setup Assistant[229]: Current Iso LC = en, en
MacBook-Pro Setup Assistant[229]: Found 2 keyboards for the locale: en
MacBook-Pro Setup Assistant[229]: SwitchController thinks we are pointed to Prod
MacBook-Pro Setup Assistant[229]: Posting MacBuddy ready
MacBook-Pro Setup Assistant[229]: Setting progress to 100%, reporting done, and aborting the progress UI
MacBook-Pro Setup Assistant[229]: ISAP: Done with phase “Setup Assistant”
MacBook-Pro Setup Assistant[229]: ISAP: Abort progress UI called.
MacBook-Pro Setup Assistant[229]: Gestures Disabled
MacBook-Pro Setup Assistant[229]: First Pane -- CountryController
MacBook-Pro Setup Assistant[229]: Warning: Attempting to initialize an mbuseragent without a user to target
MacBook-Pro Setup Assistant[229]: Setup Assistant is exiting…
MacBook-Pro Setup Assistant[229]: Warning: Attempting to initialize an mbuseragent without a user to target
... e questa è la parte equivalente di install.log dal momento in cui l'ho unbox inizialmente, fino alle mie prime interazioni utente registrate:
MacBook-Pro Language Chooser[188]: ISAP: Done with phase “Language Chooser”
MacBook-Pro SetupAssistantSpringboard[197]: Starting SetupAssistantSpringboard for user 0...
MacBook-Pro mbsystemadministration[198]: Starting MBSystemAdministration...
MacBook-Pro mbsystemadministration[198]: Adding client connection <NSXPCConnection: 0x7fdada700240> connection from pid 197
MacBook-Pro storagekitd[200]: Starting SKDaemon...
MacBook-Pro storagekitd[200]: Client entitled for destructive operations
MacBook-Pro storagekitd[200]: Adding client connection <NSXPCConnection: 0x7f8cf3700780> connection from pid 198
MacBook-Pro installd[204]: installd: Starting
MacBook-Pro installd[204]: installd: uid=0, euid=0
MacBook-Pro mbsystemadministration[198]: Connected to daemon. Language set to: English
MacBook-Pro mbsystemadministration[198]: RamDisk created at /dev/disk2
MacBook-Pro mbsystemadministration[198]: newfs_hfs: Initialized /dev/rdisk2 as a 49 MB case-insensitive HFS Plus volume
MacBook-Pro mbsystemadministration[198]: mount:
MacBook-Pro mbsystemadministration[198]: chown:
MacBook-Pro mbsystemadministration[198]: MBSetupUser: createHomeDirectory succeeded
MacBook-Pro mbsystemadministration[198]: Commit user changes: 0
MacBook-Pro mbsystemadministration[198]: Creating background user agent for uid 248
MacBook-Pro mbsystemadministration[198]: Created preferences directory at /var/setup/Library/Preferences
MacBook-Pro mbsystemadministration[198]: Copied preference file .GlobalPreferences.plist
MacBook-Pro mbsystemadministration[198]: MBSetupUser: Wrote setup user dictionary
MacBook-Pro mbbackgrounduseragent[222]: Starting MBBackgroundUserAgent...
MacBook-Pro mbbackgrounduseragent[222]: Adding client connection <NSXPCConnection: 0x7fb241f00970> connection from pid 198
MacBook-Pro mbsystemadministration[198]: MBSetupUser: disable screenlock succeeded
MacBook-Pro mbsystemadministration[198]: Setting one-time autologin user _mbsetupuser
MacBook-Pro mbsystemadministration[198]: Commit user changes: 0
MacBook-Pro mbsystemadministration[198]: CGSSessionCopyAllSessionProperties:(
{
kCGSSessionAuditIDKey = 100008;
kCGSSessionGroupIDKey = 80;
kCGSSessionIDKey = 257;
kCGSSessionLoginwindowSafeLogin = 0;
kCGSSessionOnConsoleKey = 1;
kCGSSessionSystemSafeBoot = 0;
kCGSSessionUserIDKey = 0;
kCGSSessionUserNameKey = root;
kCGSessionLoginDoneKey = 0;
kCGSessionLongUserNameKey = "System Administrator";
kSCSecuritySessionID = 100008;
}
)
MacBook-Pro SetupAssistantSpringboard[197]: Exiting successfully
MacBook-Pro mbsystemadministration[198]: Removing client connection <NSXPCConnection: 0x7fdada700240> connection from pid 197
MacBook-Pro loginwindow[83]: IASGetCurrentInstallPhaseList: no install phase array set
MacBook-Pro loginwindow[83]: IASGetCurrentInstallPhase: no install phase set
MacBook-Pro Setup Assistant[234]: Starting Setup Assistant with uid 248…
MacBook-Pro mbsystemadministration[198]: Adding client connection <NSXPCConnection: 0x7fdada4133f0> connection from pid 234
MacBook-Pro mbsystemadministration[198]: Restoring autologin user (null)
MacBook-Pro Setup Assistant[234]: Running as MacBuddy
MacBook-Pro mbsystemadministration[198]: Commit user changes: 0
MacBook-Pro mbsystemadministration[198]: couldn't get language ordering from file
MacBook-Pro mbsystemadministration[198]: There is [NO] existing Kerberos realm, running configureLocalKDC.
MacBook-Pro mbsystemadministration[198]: configureLocalKDC:
MacBook-Pro mbsystemadministration[198]: certtool systemdefault:...System identity already exists for domain com.apple.systemdefault. Done.
MacBook-Pro Setup Assistant[234]: MBSA pre MacBuddy tasks: SUCESS
MacBook-Pro Setup Assistant[234]: --- MBCopyNetworkConfig ---
MacBook-Pro Setup Assistant[234]: IP: (null)
MacBook-Pro Setup Assistant[234]: Mask: (null)
MacBook-Pro Setup Assistant[234]: Router: (null)
MacBook-Pro Setup Assistant[234]: Domain: (null)
MacBook-Pro Setup Assistant[234]: Config Method: (null)
MacBook-Pro Setup Assistant[234]: NetworkingManager: Listening for reachability information.
MacBook-Pro Setup Assistant[234]: NetworkingManager: Network unreachable: catch-all case.
MacBook-Pro Setup Assistant[234]: CloudConfigurationManager: Network unreachable. Waiting to trigger ManagedClient request.
MacBook-Pro Setup Assistant[234]: CloudConfigurationManager: Can't cancel nonexistent activation request: (null)
MacBook-Pro systemmigrationd[258]: systemmigrationd: Starting
MacBook-Pro storagekitd[200]: Client entitled for destructive operations
MacBook-Pro storagekitd[200]: Adding client connection <NSXPCConnection: 0x7f8cf3409d60> connection from pid 258
MacBook-Pro systemmigrationd[258]: Connected to daemon. Language set to: English
MacBook-Pro systemmigrationd[258]: systemmigrationd: New connection for Progress
MacBook-Pro systemmigrationd[258]: systemmigrationd: Adding client <SMDProgress_XPCClientConnection: 0x7f93f842bad0>
MacBook-Pro systemmigrationd[258]: systemmigrationd: New connection for System Selection
MacBook-Pro systemmigrationd[258]: systemmigrationd: Adding client <SMDSystemScanner_XPCClientConnection: 0x7f93f8439c10>
MacBook-Pro systemmigrationd[258]: Inform Remote Client of new System A63B3DED-C9E5-41A0-A25F-0D1E2B004506
MacBook-Pro systemmigrationd[258]: systemmigrationd: New connection for Progress
MacBook-Pro systemmigrationd[258]: systemmigrationd: Adding client <SMDProgress_XPCClientConnection: 0x7f93f861feb0>
MacBook-Pro Setup Assistant[234]: Current Language=en, 10 countries found. 228 known
MacBook-Pro Setup Assistant[234]: Current Iso LC = en, en
MacBook-Pro Setup Assistant[234]: Found 2 keyboards for the locale: en
MacBook-Pro Setup Assistant[234]: SwitchController thinks we are pointed to Prod
MacBook-Pro Setup Assistant[234]: Posting MacBuddy ready
MacBook-Pro Setup Assistant[234]: Setting progress to 100%, reporting done, and aborting the progress UI
MacBook-Pro Setup Assistant[234]: ISAP: Done with phase “Setup Assistant”
MacBook-Pro Setup Assistant[234]: ISAP: Abort progress UI called.
MacBook-Pro Setup Assistant[234]: Gestures Disabled
MacBook-Pro Setup Assistant[234]: First Pane -- CountryController
MacBook-Pro Setup Assistant[234]: Warning: Attempting to initialize an mbuseragent without a user to target
MacBook-Pro Setup Assistant[234]: Country set successfully
MacBook-Pro Setup Assistant[234]: Local set successfully
MacBook-Pro Setup Assistant[234]: IntlSetValue(0, "AppleDateResID", 0) returned 0
MacBook-Pro Setup Assistant[234]: IntlSetValue(0, "AppleTimeResID", 0) returned 0
MacBook-Pro Setup Assistant[234]: IntlSetValue(0, "AppleNumberResID", 0) returned 0
MacBook-Pro Setup Assistant[234]: User has chosen US set locale to: en_US. result=(en,US)
MacBook-Pro Setup Assistant[234]: NSLocale: US
MacBook-Pro Setup Assistant[234]: Next Pane -- from CountryController
MacBook-Pro Setup Assistant[234]: Next Pane -- to SelectKeyboard
MacBook-Pro Setup Assistant[234]: Warning: Attempting to initialize an mbuseragent without a user to target
MacBook-Pro Setup Assistant[234]: Current Iso LC = en, en
MacBook-Pro Setup Assistant[234]: Found 2 keyboards for the locale: en_US
MacBook-Pro Setup Assistant[234]: User selected input method: U.S. (resID=0, scriptID=0, bundleID=com.apple.keyboardlayout.all)
MacBook-Pro Setup Assistant[234]: User selected typing styles: <_NSCachedIndexSet: 0x7fbbe2409150>[number of indexes: 1 (in 1 ranges), indexes: (0)]
MacBook-Pro Setup Assistant[234]: Keyboards: Current Input Source <TSMInputSource 0x7fbbe25a4460> KB Layout: U.S. (id=0)
MacBook-Pro Setup Assistant[234]: Keyboards: Current source is layout, ASCII capable
MacBook-Pro Setup Assistant[234]: Keyboards: Default ASCII layout: <TSMInputSource 0x7fbbe25a4460> KB Layout: U.S. (id=0)
MacBook-Pro Setup Assistant[234]: Keyboards: Current ASCII layout: <TSMInputSource 0x7fbbe25a4460> KB Layout: U.S. (id=0)
MacBook-Pro Setup Assistant[234]: Next Pane -- from SelectKeyboard
MacBook-Pro Setup Assistant[234]: TIS setting succeeded
Una cosa che ho notato della sessione dei 2 mesi precedenti era che la primissima voce era: MacBook-Pro Language Chooser[178]: LCA+BT2: BT host controller appeared after 2 seconds , che sembra essere correlata a USB o Bluetooth (ma non ne sono sicuro).
Dai log sembra che Setup Assistant stia facendo cose normali. Visualizza semplicemente il riquadro Selezione paese, quindi esce, il che sembra indicare che il laptop è stato aperto, l'assistente di installazione ha caricato il selettore di paese, quindi il computer è stato spento.
Le mie domande sono:
- Potrebbe essere il risultato di un passaggio di controllo qualità in fabbrica, o è sicuramente un'indicazione che il MacBook è stato aperto da qualcuno negli Stati Uniti prima di acquistarlo?
- Questo computer mi è stato fornito da un'organizzazione. È possibile che sia stata l'organizzazione a aprirlo e che l'hanno fatto con l'intento di installare qualche forma di spyware prima di riavvolgere il computer nel cellophane in modo che non lo sapessi?
Un'altra cosa importante da notare è che i timestamp nei registri discutibili erano solo per ca. una finestra di 30 secondi, da "BT host controller" a "Setup Assistant sta per uscire", e questo è il limite.
Modifica da aggiungere: Ho già preso in considerazione la possibilità che questo possa essere collegato a ntp aggiornando l'orologio di sistema quando il computer fa il primo contatto con Internet, ma questo non era assolutamente il caso. Ciò accade un po 'più tardi nel log poco dopo l'unboxing, ed è chiaro che sta accadendo a quel punto perché i timestamp viaggiano indietro nel tempo di circa 4 minuti.
Ho anche dimenticato di menzionare la versione del sistema operativo al momento: era OS X 10.11 El Capitan. Modifica: l'installazione iniziale era in realtà OS X 10.10 Yosemite; l'aggiornamento a El Capitan è avvenuto diverse ore più tardi.
Modifica il giorno successivo da aggiungere:
Ho effettuato alcune analisi comparative di un MacBook Pro separato che possiedo e, in base ai vari tempi di creazione / accesso / modifica di determinati file di sistema e account utente nascosti, potrebbe non essere insolito trovare pre-unboxing artefatti in /var/log/install.log .
Tuttavia, non ho un install.log da confrontare che abbia ancora le sue voci di registro originali prima unboxing intatte, quindi non sono stato in grado di confrontare le righe in questo specifico install.log (sopra) per determinare se l'attività è insolita o no.
Se qualcuno ha un MacBook Pro acquistato di recente, o uno che conosce ha sempre avuto il sistema operativo installato una volta (subito dopo l'unboxing), specialmente uno che inizialmente ha installato OS X 10.10 Yosemite (inizio e metà 2015) modelli), sarebbe di grande aiuto se potessi fornire le tue prime voci /var/log/install.log post-unboxing, quindi possiamo vedere se il comportamento precedente è insolito.
In particolare, mi piacerebbe sapere se è normale che un nuovo MacBook Pro abbia voci install.log che precedono il loro acquisto, in cui è installato Setup Assistant ( First Pane -- CountryController ). Mi piacerebbe anche sapere se LCA+BT2: BT host controller appeared after 2 seconds è normale vedere in quelle voci, o se è un'indicazione che una periferica USB o Bluetooth è stata collegata.
Se hai accesso a un computer di questo tipo e desideri aiutare, controlla l'output di head -200 /var/log/install.log | less e fammi sapere cosa trovi (facendo attenzione a non condividere dati sensibili che potrebbero emergere). Grazie.