xpcroleaccountd
executablemacOS171.4 KBx86_64, arm64
Security certificate tool — manages keychain access and code signing operations
Performs cryptographic operations involving keychain access, certificate management, and code signing validation. Communicates with multiple network endpoints and accesses extended file paths beyond standard application sandboxing. Exposes three XPC services for inter-process communication with other system components. Handles security-sensitive operations involving certificates and signing credentials stored in the system keychain.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 171.4 KB
- UUID
- 952FC3B1-CEF2-31F9-BD1E-ED4E90944799
- Analyzed
- 2026-04-09T10:12:41Z
- CDHash
- 2cbc38a13fae5ce87ef1765ff9aa2b1c0836300b2e08a532ec1ab8aa9429b500
Capabilities
StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-onlyStorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-writeSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityEntitlements6
Interesting Strings
Bundle IDs(24)
-com.apple.rootless.storage.RoleAccountStaging/AppleInternal/Library/BuildRoots/4~B_wmugDgJ2N2f5ZSwF8D1OxuTMzN48riXDKBxbA/Library/Caches/com.apple.xbs/Binaries/libxpc_executables/install/Symbols/xpcroleaccountd/Library/Preferences/com.apple.security.xpc.plist/private/var/db/com.apple.xpc.roleaccountd.staging/private/var/db/com.apple.xpc.roleaccountd.staging/exec
File Paths(15)
/AppleInternal/Library/BuildRoots/4~B_wmugDgJ2N2f5ZSwF8D1OxuTMzN48riXDKBxbA/Library/Caches/com.apple.xbs/Binaries/libxpc_executables/install/Symbols/xpcroleaccountd/Library/Preferences/com.apple.security.xpc.plist/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/Frameworks/Security.framework/Versions/A/Security
URLs & Endpoints(6)
$http://crl.apple.com/codesigning.crl0%http://www.apple.com/appleca/root.crl0<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><string>com.apple.compilers.llvm.clang.1_0</string>
Network Surface
Networking Frameworks
Endpoints(12)
Hostnamelibxpc-3089.41.2
Ipv4100.6.1.9
Hostnamefield.1.2.840.113635.100.6.1.9
Ipv601:14:00
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
2
Hardware
0
IPC
0
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
6
Telemetry Strings
0
File Paths
15
Bundle IDs
24
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 79 functions identified
Functions(79)
0x100000a18sub_100000a18
0x100000b64sub_100000b64
0x100000cacsub_100000cac
0x100000db4sub_100000db4
0x100000dfcsub_100000dfc
0x100000ed0sub_100000ed0
0x100000ee4sub_100000ee4
0x100000f1csub_100000f1c
0x100000f94sub_100000f94
0x100001004sub_100001004
0x100001134sub_100001134
0x100001190sub_100001190
0x1000011d4sub_1000011d4
0x100001218sub_100001218
0x100001314sub_100001314
0x10000135csub_10000135c
0x1000013d8sub_1000013d8
0x100001630sub_100001630
0x100001e5csub_100001e5c
0x100001e64sub_100001e64
Imports111 symbols from 5 dylibs
Exports1
_mh_execute_header0x0