What is syspolicyd on Mac?
syspolicyd decides whether code is allowed to run. Every downloaded app, and many freshly built binaries, get assessed the first time they launch. On a developer’s Mac that can add up to real CPU and slower first runs.
Updated
- Process
syspolicyd- Comes from
- macOS
- Safe?
- Safe and important. It is Gatekeeper; don’t try to disable it, tune it instead.
What syspolicyd does
syspolicyd (/usr/libexec/syspolicyd, running as root) is the system policy daemon behind Gatekeeper. When something tries to run, especially an app downloaded from the internet (it has a com.apple.quarantine attribute), syspolicyd:
- checks its code signature and Developer ID
- checks its notarization ticket, stapled or online
- coordinates an XProtect malware scan
- records your “Open anyway” decisions from System Settings › Privacy & Security
It also applies the approval policy for third-party kernel extensions.
Why it uses CPU
- Opening a big new app: the first launch of a large download (Xcode, an IDE, a game) is assessed in full, which can take tens of seconds.
- Developer workflows: compilers, test runners and package managers create new executables constantly. Rust, Go, Swift and native Node modules all produce fresh binaries that may be scanned on first launch.
- Unsigned or ad-hoc signed tools from Homebrew or
curl | shinstallers. - Network trouble: an online notarization check that has to time out.
How to make it calm down
The single most useful step for developers is the Developer Tools exemption. Processes launched by an app on this list skip Gatekeeper’s first-run checks:
- Run this once so the setting appears:
spctl developer-mode enable-terminal
- Open System Settings › Privacy & Security › Developer Tools and turn on Terminal (and iTerm, Ghostty, VS Code or Cursor if you build from there).
- Restart the terminal app.
Other things that help:
- Check how an app is being assessed:
spctl --assess --verbose=4 /Applications/Some.app. - For a file you trust, remove the quarantine flag:
xattr -d com.apple.quarantine ./tool. - Keep macOS updated: XProtect and syspolicyd fixes ship in point releases.
When to worry
The genuine daemon is at /usr/libexec/syspolicyd:
codesign -dv --verbose=2 /usr/libexec/syspolicyd 2>&1 | grep -E 'Identifier|Authority'
You should see com.apple.syspolicyd and Software Signing. A syspolicyd spike right after you open something new is the system working. Repeated Gatekeeper warnings about an app you didn’t install, or an app that “will damage your computer,” are the real red flag: move it to the Trash.
Seeing it in Stat Space
Stat Space’s process inspector shows, for any process, the signer (Apple, Mac App Store, Developer ID name, ad-hoc or unsigned), Team ID, whether it’s notarized, whether it uses the hardened runtime, its sandbox status and notable entitlements. That’s most of what syspolicyd checks, visible before you decide to trust something.
Questions
Can I turn off Gatekeeper?
On current macOS, sudo spctl --master-disable no longer simply switches it off; you also have to confirm in Privacy & Security, and it weakens protection for every app. For development, the Developer Tools exemption is the better fix.
Why is the first run of my test binary slow?
syspolicyd and XProtect scan new executables before their first launch. Adding your terminal under Developer Tools in Privacy & Security exempts what it launches.
Does syspolicyd send data to Apple?
It can check an app’s notarization ticket online when the ticket isn’t stapled to the app. That lookup is about the app’s code signature, not your files.
Know what your Mac is doing, without adding to it.
Free, no account. Pro is $9.99 once for the first 100 buyers.