usermanagerd
executablemacOS1.2 MBx86_64, arm64
System security daemon — manages keychain, code signing, and device encryption
Provides cryptographic operations and credential management for macOS security infrastructure. Accesses the device key bag to handle encryption keys and maintains keychain operations for stored certificates and credentials. Enforces code signing validation and manages trust decisions for executable verification. Exposes 10 XPC services to allow other system components to request signing, verification, and keychain operations. Communicates with 7 network endpoints, likely for certificate revocation checking or trust anchor updates.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.2 MB
- UUID
- A293E602-6A0A-34A3-B979-DC4A5294A792
- Analyzed
- 2026-04-09T10:11:21Z
- CDHash
- 31f219d30514fcf8494bc45b6886e2f2db10df9aef24bcd6c174f1a64844e490
Capabilities
KeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks13
Entitlements21
Interesting Strings
Bundle IDs(88)
File Paths(18)
/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/ACMLib/ACMLib.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/CommonUtil.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCall.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibCallBlock.c/AppleInternal/Library/BuildRoots/4~B_wCugD1GT6JPDmhh1RrUK5pccLqhjehz9nqD_o/Library/Caches/com.apple.xbs/Sources/AppleCredentialManager_ClientLibs/common/LibSerialization.c
Network Surface
Networking Frameworks
Endpoints(7)
API Usage
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
0
Hardware
1
IPC
0
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
0
File Paths
18
Bundle IDs
88
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1275 functions identified
Functions(1275)
0x100001138+[RDServer sharedServer]
0x1000011d8sub_1000011d8
0x100001228+[RDServer sharedXPCInterface]
0x10000126csub_10000126c
0x1000012bc+[RDServer sharedBubbleXPCInterface]
0x1000012c4-[RDServer init]
0x10000132c-[RDServer remoteProcessHasBooleanEntitlement:]
0x1000013d8-[RDServer retrievePasscodeFromFileHandle:ofLength:withbaseaddress:]
0x100001514-[RDServer addClient:]
0x1000015bcsub_1000015bc
0x1000016a4sub_1000016a4
0x1000016e0sub_1000016e0
0x10000171c-[RDServer removeClient:]
0x1000017c4sub_1000017c4
0x1000019c4-[RDServer addBubbleClient:]
0x1000019c8-[RDServer removeBubbleClient:]
0x1000019cc-[RDServer _clientForPID:]
0x100001a78-[RDServer _enumerateClientsWithBlock:]
0x100001be0-[RDServer criticalStakeHolder]
0x100001d48-[RDServer bubbleStakeHolder]
Imports313 symbols from 11 dylibs
Exports1
_mh_execute_header0x0