Workaround for:Unapproved caller. SecurityAgent may only be invoked by Apple software

[Sub-o]

Hi guys,
There doesn't seem to be a lot of chat about this message on the Forum, so I'm posting a workaround for the issue.
In my case I got the message "Unapproved caller. SecurityAgent may only be invoked by Apple software" when trying to boot from my CC Clone on the HDD in the optibay.
I Googled the message and found a range of answers, including hardware fixes. But I was pretty sure, this wasn't a hardware problem.
While this may not work for anyone with a single boot drive, it should work for anyone with a bootable backup.
All I did was have CCC do a new clone, deleting all files not in original. Except I unticked the "var" folder.
Now my MBP boots from the second HDD, with no issues.

It's still a head scratcher, though.....as both my MBP & Mini will happily boot from the CCC on the external connected to the Mini.

 

[chaosmind]

contents of /var/folders may be culprit

I had the exact same message come up, although with me it was pretty close to right after the imaging step... It caught me in a vicious loop where I couldn't even log in, so:

Reboot into single user mode, run fsck and mount the root partition. Then, this:

rm -R /var/folders/*

That seemed to do the trick. Got my answer from here, BTW:
https://discussions.apple.com/thread/5600203?start=30&tstart=0

 

[mimimelo]

Ununapproved caller apple software: SOLVED!

After doing lots of reading everywhere and trial and error, and getting very frustrated about this stupid "Ununapproved caller" apple message this is what worked for me:
(Please pay close attention to the way the text is written and when there is a space. If you don't enter it exactly, it won't work)

- Start on single user mode: Hit the Command and S keys at start-up

Wait until the writing stops completely

-At the line, type (after root): /sbin/fsck -fy (space after the k)
Hit the ENTER key

wait until it finishes and says "... appears to be OK"

next, type: /sbin/mount -uw / (space after the t and after the w)
Hit the ENTER key

then type: rm -Rf /var/folders/* (space after the m and the f)

Hit the ENTER key

Run FSCK again (I did, just in case, but you may not have to):
/sbin/fsck -fy

Finally, type REBOOT, hit ENTER and wait until computer starts.

Hope it works for you all as well as it did for me!

 

[beau42]

unaproved caller, only apple security agent etc.

the problem lies in an old identity for your mac trying to log into your keychain. in my case it was via the time capsule. the two identities simultaneously touch the key chain which then freezes and then in turn freezes the Time capsule requiring a hard restart. if you check airport utility you may see an obsolete machine name there which the Airport gets from your internet router. you may either manually login to your router and remove old profiles or easier, turn off the router for a few minutes and turn it on again. a check will show that only the current machine names are listed. your machine should now be lightning fast, quiet, and stable

 

[0970373]

After doing lots of reading everywhere and trial and error, and getting very frustrated about this stupid "Ununapproved caller" apple message this is what worked for me:
(Please pay close attention to the way the text is written and when there is a space. If you don't enter it exactly, it won't work)

- Start on single user mode: Hit the Command and S keys at start-up

Wait until the writing stops completely

-At the line, type (after root): /sbin/fsck -fy (space after the k)
Hit the ENTER key

wait until it finishes and says "... appears to be OK"

next, type: /sbin/mount -uw / (space after the t and after the w)
Hit the ENTER key

then type: rm -Rf /var/folders/* (space after the m and the f)

Hit the ENTER key

Run FSCK again (I did, just in case, but you may not have to):
/sbin/fsck -fy

Finally, type REBOOT, hit ENTER and wait until computer starts.

Hope it works for you all as well as it did for me!

THANK YOU!!!! I am crossing my fingers that this did the trick. I still don't understand how it happened. I tried another suggestion to just delete that var/folders folder but it kept coming back. So far, your method has stuck.

UPDATE: The problem came back. But I think I figured out what the problem was. I started getting these errors when I upgraded my other MBP to Yosemite. I think because the iCloud drive updated, it's causing some kind of conflict/error on the one I left on Mavericks. I decided to see if the problem went away if I upgraded the problem Mac to Yosemite as well. Looks like the issue went away for real this time. Cross fingers that it stays away.

 

[beau42]

Unapproved caller

the problem lies in an old identity for your mac trying to log into your keychain. in my case it was via the time capsule. the two identities simultaneously touch the key chain which then freezes and then in turn freezes the Time capsule requiring a hard restart. if you check airport utility you may see an obsolete machine name there which the Airport gets from your internet router. you may either manually login to your router and remove old profiles or easier, turn off the router for a few minutes and turn it on again. a check will show that only the current machine names are listed. your machine should now be lightning fast, quiet, and stable

Well, not quite as described.
The machine still hung. thinking about the "cable fault" idea i, disassembled the machine and checked the connectors. the second drive connector was loose as well as the connector to the Wifi assembly. i pressed them home firmly, reassembled and restarted. the machine was better, but still prone to hanging. i ran Disk Warrior and rebuilt the main drive. so far, the machine is good. The clue is a return of a clock error followed by a hang on utility: "sudo sysdiagnose -f ~/desktop/" made readable in Text Wrangler. I judged some part of the machine failed to coordinate thus the timing error, perhaps the added second disk. uptime now 24 hours plus and holding thumbs.

 

[0970373]

Sadly, my fix did not stick. The problem has returned. I just checked all the cable connections and am reinstalling the OS. What a pain this is.

 

[beau42]

Unapproved caller

Sadly, my fix did not stick. The problem has returned. I just checked all the cable connections and am reinstalling the OS. What a pain this is.

I too have been disappointed for the umpteenth time.

http://www.techrepublic.com/article/how-to-restore-an-os-x-recovery-partition/
The above is a link to a method for reinstalling the recovery partition. If you delete it, a clean install does not recreate it.
My machine was working fine until i did a CCC BACKUP that requested to do a fix to recovery partition (after a rebuild of the disk by DiskWarrior). After this, all the old problems came back. Research indicates that recovery disk is not passive but participates actively in the boot process.
To test the boot partition, download and run OS X recovery disk assistant, If it refuses to build a recovery disk, the disk is corrupted. To rebuild it follow the link above. A rebuilt recovery partition and DiskWarrior have now got me fault free for five days.

 

[jido]

So, I kept getting these reaaally annoying and frustrating Unapproved caller errors, I could not open Network Preferences, the wifi did not connect automatically on wake, Mail did not download new messages and when I tried restarting it crashed.

This thread got me wondering what was in /var/folders.

I went and did:

$ cd /var/folders
$ ls -l
total 0
drwxr-xr-x   3 root  wheel   102 Nov 28 21:24 3l
drwxr-xr-x   3 root  wheel   102 Nov 28 21:58 d4
drwxr-xr-x   3 root  wheel   102 Nov 28 21:59 k0
drwxr-xr-x  23 root  wheel   782 Dec 19 21:48 zz

I saw that the most recently modified folder was "zz". I looked inside it and found this subfolder that was modified on 19 December:

drwxr-xr-x  3 _lp              _lp              102 Dec 19 21:48 zyxvpxvq6csfxvn_n000003800000t

This folder belongs to _lp, which is an account related to the printing system:

$ fgrep _lp /etc/passwd
_lp:*:26:26:Printing Services:/var/spool/cups:/usr/bin/false

So I just deleted the folder using my administrator superpowers:

$ sudo rm -rf zz/zyxvpxvq6csfxvn_n000003800000t
Password:

After which, I restarted the Mac and all is well. All the symptoms I had are gone.

I will watch out next time I touch anything to do with printing, but for now I feel much better about my computer

 

[thearmlesswonde]

So, I kept getting these reaaally annoying and frustrating Unapproved caller errors, I could not open Network Preferences, the wifi did not connect automatically on wake, Mail did not download new messages and when I tried restarting it crashed.

This thread got me wondering what was in /var/folders.

I went and did:

$ cd /var/folders
$ ls -l
total 0
drwxr-xr-x   3 root  wheel   102 Nov 28 21:24 3l
drwxr-xr-x   3 root  wheel   102 Nov 28 21:58 d4
drwxr-xr-x   3 root  wheel   102 Nov 28 21:59 k0
drwxr-xr-x  23 root  wheel   782 Dec 19 21:48 zz

I saw that the most recently modified folder was "zz". I looked inside it and found this subfolder that was modified on 19 December:

drwxr-xr-x  3 _lp              _lp              102 Dec 19 21:48 zyxvpxvq6csfxvn_n000003800000t

This folder belongs to _lp, which is an account related to the printing system:

$ fgrep _lp /etc/passwd
_lp:*:26:26:Printing Services:/var/spool/cups:/usr/bin/false

So I just deleted the folder using my administrator superpowers:

$ sudo rm -rf zz/zyxvpxvq6csfxvn_n000003800000t
Password:

After which, I restarted the Mac and all is well. All the symptoms I had are gone.

I will watch out next time I touch anything to do with printing, but for now I feel much better about my computer

Hello, thank you for this, i have the sam thing when my system wakes up. I did see that i also have ZZ

drwxr-xr-x 24 root wheel 816 Feb 12 12:38 zz

How do I find out what folder it is ? or open it for that matter ?

Thanks in advance

 

[jido]

Hello, thank you for this, i have the sam thing when my system wakes up. I did see that i also have ZZ

drwxr-xr-x 24 root wheel 816 Feb 12 12:38 zz

How do I find out what folder it is ? or open it for that matter ?

Thanks in advance

Unfortunately the problem returned even though I saw no new change in /var/folders. I ended up deleting everything there (as described by others), hope it works.

 

[Jtte]

I want to add something to these instructions for Mojave (10.14.x). Today, 02/25/19, I tried the common instructions of deleting the contents of private/var/folders/ ( usually presented as /var/folders ) by booting into single user mode with command s and typing a bunch of instructions listed all over the Internet.

But Mojave wouldn't let me delete the contents of /var/folders even in single-user mode because Mojave's SIP protects that folder (among numerous others).

FIX: first diable SIP then follow the typical instructions to delete the contents of /var/folders then enable SIP.

1. Disable SIP
- boot into Recovery Mode (with command r during restart)
- choose a language then click the pull-down menu Utilities (ignore the big menu choices in the center of the screen) and click Terminal
- type csrutil disable
and press return or enter
- quit Terminal and reboot in single-user mode ( command s )

2. Delete the contents of var/folders/ after booting into single-user mode with command s
- Type rm -Rf /var/folders/*
and press return or enter
(If you get an error, type this first:
/sbin/mount -uw /
and press return or enter)

3. Enable SIP
- boot into Recovery Mode with command r during startup
- choose a language then ignore the big menu in the center of the screen and click the Utilities pull-down at the top of the screen and click Terminal
- type csrutil enable
- quit terminal and restart normally

Whewwwww.

Ununapproved caller apple software: SOLVED!

After doing lots of reading everywhere and trial and error, and getting very frustrated about this stupid "Ununapproved caller" apple message this is what worked for me:
(Please pay close attention to the way the text is written and when there is a space. If you don't enter it exactly, it won't work)

- Start on single user mode: Hit the Command and S keys at start-up

Wait until the writing stops completely

-At the line, type (after root): /sbin/fsck -fy (space after the k)
Hit the ENTER key

wait until it finishes and says "... appears to be OK"

next, type: /sbin/mount -uw / (space after the t and after the w)
Hit the ENTER key

then type: rm -Rf /var/folders/* (space after the m and the f)

Hit the ENTER key

Run FSCK again (I did, just in case, but you may not have to):
/sbin/fsck -fy

Finally, type REBOOT, hit ENTER and wait until computer starts.

Hope it works for you all as well as it did for me!

 

[yms137]

I want to add something to these instructions for Mojave (10.14.x). Today, 02/25/19, I tried the common instructions of deleting the contents of private/var/folders/ ( usually presented as /var/folders ) by booting into single user mode with command s and typing a bunch of instructions listed all over the Internet.

But Mojave wouldn't let me delete the contents of /var/folders even in single-user mode because Mojave's SIP protects that folder (among numerous others).

FIX: first diable SIP then follow the typical instructions to delete the contents of /var/folders then enable SIP.

1. Disable SIP
- boot into Recovery Mode (with command r during restart)
- choose a language then click the pull-down menu Utilities (ignore the big menu choices in the center of the screen) and click Terminal
- type csrutil disable
and press return or enter
- quit Terminal and reboot in single-user mode ( command s )

2. Delete the contents of var/folders/ after booting into single-user mode with command s
- Type rm -Rf /var/folders/*
and press return or enter
(If you get an error, type this first:
/sbin/mount -uw /
and press return or enter)

3. Enable SIP
- boot into Recovery Mode with command r during startup
- choose a language then ignore the big menu in the center of the screen and click the Utilities pull-down at the top of the screen and click Terminal
- type csrutil enable
- quit terminal and restart normally

Whewwwww.

[doublepost=1557056846][/doublepost]THANK YOU! After many attempts at other "fixes" this (from mimimelo) is the one that seems to have worked for me.

 

[yms137]

[doublepost=1557056846][/doublepost]
THANK YOU! After many attempts at other "fixes" this (from mimimelo) is the one that seems to have worked for me.

[doublepost=1557370819][/doublepost]I take that back. The unapproved caller didn't give up and I had to do a full wipe and re-install. THAT WORKED! Having everything in the cloud and on an external drive actually was less painful than trying all the other suggestions, none of which worked anyway (at least not for me). I wish I knew what the culprit was though so I can avoid it happening again. Now I'm hesitant to every add any more software.