What are syspolicyd and trustd on Mac?

What syspolicyd does

Its manual page (type man syspolicyd in Terminal) calls it the System Policy daemon and says it "embodies the system policy controlling what may be installed, loaded, executed, or otherwise used on the system". Other parts of macOS ask it for a verdict before something new runs or installs.

Apple's support pages don't name syspolicyd, but the tools around it tie it to Gatekeeper. The manual page for spctl, the command-line side of Gatekeeper, uses the same policy database, /var/db/SystemPolicyConfiguration/SystemPolicy, and lists syspolicyd under "see also". Gatekeeper's job, in Apple's words, is to check that software "is from an identified developer, is notarized by Apple to be free of known malicious content, and hasn't been altered", and to ask you before downloaded software opens for the first time (Apple Platform Security, Gatekeeper and runtime protection). Some of those checks go online: Apple says Gatekeeper checks "if an app contains known malware and whether the developer's signing certificate is revoked" (Apple, Safely open apps on your Mac).

You can ask the same policy a question yourself. This is read-only and needs no password:

spctl -a -vv "/Applications/Google Chrome.app"

On our MacBook Pro with macOS 27.0.1 it printed accepted, source=Notarized Developer ID and the developer's name and team ID. Swap in any app's path. spctl --status prints assessments enabled when Gatekeeper's checks are on, as they are by default.

syspolicyd also has its own schedule. On macOS 27.0.1, its launch settings (/System/Library/LaunchDaemons/com.apple.security.syspolicy.plist) list background tasks with names such as check.revocation, xprotect-update and measure, set to run at maintenance priority, two of them marked as CPU-intensive. Apple doesn't document what each one does, but it explains why syspolicyd can wake up when you haven't opened anything new.

What trustd does

trustd's manual page is one line: it "provides services for evaluating trust in certificates for all processes on the system". Any time macOS or an app needs to know whether a certificate is genuine and still valid, trustd answers. That covers code signatures, and it covers secure connections: every HTTPS website, mail server and app that talks to the internet relies on certificate checks.

Part of that work is checking for revoked certificates. Apple says its devices get a regularly updated list of revoked certificates, and that some checks need a live answer from the certificate's issuer, called an OCSP response (Apple Platform Security, TLS security). Apple's developer documentation adds that a trust check "might require network access to fetch intermediate certificates, or to perform revocation checking" (Apple, SecTrustEvaluateWithError).

Don't be surprised to see several copies. On our Mac, Activity Monitor and ps showed one trustd for the system (running as the user _trustd), one in our own account, and small ones for system services such as location. syspolicyd runs once, as root.

Why they get busy, and what's normal

Both do their work in short bursts, when something new needs checking. These are the likely triggers:

• Installing or opening new software. A new app, a large app with many components (Xcode, Adobe apps, games), or a batch of apps restored by Migration Assistant all get checked as they first run.
• Apps that update themselves. Apple says macOS checks an app for known malware again when it "has been changed (in the file system)", and when its signatures update (Apple Platform Security, Protecting against malware). A browser or chat app that updates itself in the background can start a round of checks.
• Your own builds. Compiling and running code produces new executables again and again, and each one can need checking.
• A network that blocks Apple's certificate servers. Apple lists the hosts that company networks must allow for certificate checks (ocsp.apple.com, ocsp2.apple.com, crl.apple.com, valid.apple.com, certs.apple.com) and for notarization (api.apple-cloudkit.com) in Use Apple products on enterprise networks. A firewall, VPN or ad-blocking hosts list that blocks them stops those checks completing normally.

What's normal: a short spike while you install or first open something, then back to almost nothing. Worth a look: either one staying near the top of Activity Monitor's CPU list for many minutes when you aren't installing or opening anything.

If Gatekeeper's online checks make you wonder about privacy, Apple says it has never combined data from these checks with information about Apple users or their devices, and that it doesn't log IP addresses for Developer ID certificate checks (Apple).

How to tell they're the real ones

Malware sometimes borrows system-sounding names, so it's reasonable to check. Both files live in /usr/libexec, on the read-only system volume that Apple signs and macOS verifies while it runs; on Apple silicon, the startup process checks that seal before macOS loads (Apple Platform Security, Signed system volume security). To see the path and the signature, run these read-only commands:

ps -axo pid,user,comm | grep -E "syspolicyd|trustd"
codesign -dv --verbose=2 /usr/libexec/syspolicyd

The first should list /usr/libexec/syspolicyd and /usr/libexec/trustd. The second should include Authority=macOS Software Signing, Authority=Apple Code Signing Certification Authority and Authority=Apple Root CA, as it did on our Mac. A process with either name running from anywhere else is worth investigating; What is XProtect? covers what macOS already does about malware.

What to do if they stay busy

1. Let a round of checks finish. After installing several apps or migrating to a new Mac, give it some time with the Mac awake and online.
2. Notice what you opened. If the burst comes every time you open one particular app, check that app with spctl -a -vv as above. Anything other than accepted means its signature has a problem: download a fresh copy from the developer.
3. Check your network tools. If you use a firewall app, VPN or content blocker, make sure it isn't blocking the Apple hosts listed above.
4. Update macOS and restart. System Settings › General › Software Update. A restart also ends any check that got stuck.
5. For developers: Apple has a setting for this case. System Settings › Privacy & Security › Developer Tools lets apps you add, such as Terminal, "run software that doesn't meet the system's security policy" (Apple). That's a real reduction in protection for everything those apps start, and Apple doesn't say it makes builds faster, so only add an app if you know why you need it.

If the Mac is slow in general rather than just after installs, Why is my Mac so slow? walks through the other causes, and how to read Activity Monitor explains the CPU figures.

What not to do

• Don't quit them in Activity Monitor. They aren't your processes: Activity Monitor asks for an administrator password and warns that quitting may stop macOS operating correctly. macOS starts them again the next time something needs a check, so nothing is gained.
• Don't try to switch Gatekeeper off. It's the check that stops known malware opening, and since macOS 15 Sequoia the spctl manual page says commands that edit its rule database are no longer supported. For a single app you trust, use Privacy & Security › Open Anyway, which Apple keeps available for about an hour after you try to open it, and which Apple pairs with a warning that overriding security settings is "the most common way that a Mac gets infected with malware" (Apple, Open a Mac app from an unknown developer). “Apple could not verify” a Mac app has the steps and the checks to make first.
• Don't turn off System Integrity Protection. It has nothing to do with this CPU use, and Apple's advice is to disable it "only temporarily to perform necessary tasks" (Apple Developer).
• Don't block Apple's servers or delete files in /var/db. Blocking the certificate hosts breaks checks rather than speeding them up, and the policy database belongs to macOS.

How Tend helps

Tend's free Security check shows whether Gatekeeper and System Integrity Protection are on, and reads the signature of every app in your Applications folder: it lists apps that don't come from a notarized developer or the App Store, and flags a signature that's broken because the app changed after it was signed. That's the quickest way to find the app that keeps sending syspolicyd back to work. Tend only reads these things and tells you where to change them; it isn't antivirus.

Questions

Related guides

Sources

• Apple, man syspolicyd, man trustd and man spctl on macOS 27.0.1
• Apple Platform Security, Gatekeeper and runtime protection in macOS
• Apple Platform Security, Protecting against malware in macOS
• Apple Platform Security, TLS security
• Apple Platform Security, Signed system volume security
• Apple, Safely open apps on your Mac
• Apple, Open a Mac app from an unknown developer
• Apple, Control the ability of apps to run software that doesn't meet the system's security policy on Mac
• Apple, Use Apple products on enterprise networks
• Apple Developer, SecTrustEvaluateWithError and Disabling and Enabling System Integrity Protection

Spotted something out of date? Tell us and we'll fix it.