I wrote a shellscript to debug the update-process in more detail.

It displays:
1. The changedates of the relevant files.
2. The version of the malware-def
3. Entries related to XProtect from System.log

You might need to modify the username for the grep-command though. Mine is "admin".


#!/bin/bash
# this is to test the XProtectUpdater-service.

XPROTECT_DIR="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/"
LOG_DIR="/private/var/log/"

echo
echo -e "\033[1;37m META-INFO \033[0m"
ls -l ${XPROTECT_DIR}XP*

echo
echo -e "\033[1;37m META-CONTENT \033[0m"
defaults read ${XPROTECT_DIR}XProtect.meta

echo
echo -e "\033[1;37m SYSTEM.LOG \033[0m"
su admin -c "grep XProtect* ${LOG_DIR}System.log"

Nice looking widget. How about adding a "Force Update" button that runs:

sudo /usr/libexec/XProtectUpdater

Well the trick is that it's a sudo command, so there needs to be a way to authenticate via GUI. I can map that command to a button, but then it freezes the widget because there is no user interface to authenticate to. So rather than figure out a way (maybe I could have it spawn a terminal window that is fed the sudo command that then prompts? But that is sort of inelegant for a widget) So, I figure I'll leave that in the hands of Apple, the only apparent way is to force an update is to toggle the setting on and off in the Security prefPane. So for now it'll be a purely informational widget. Thanks of the suggestion though!

Maybe applescript to authenticate?

osascript -e 'do shell script "sudo /usr/libexec/XProtectUpdater" with administrator privileges'

I think I recall reading some Apple KB article saying you shouldn't use 'sudo' with 'with administrator privileges' (ie. I think your applescript shell script will work without sudo - though I'm not positive on that.)

Thanks for this hint - this was an interesting exercise running these scripts.

I'd installed the Apple Security update when it came out 1st June, and noted it reset some of my Safari prefs. I have Open Safe Files off by default - it was turned back on after the security update. I turned it back OFF again. iMac has been rebooted several times since then. Safari is my main browser.

I ran the first script, which informed me the modification date was 1st June. I ran the second script, which told me the version number was 1.

I then unchecked/checked the updates box in Security prefs to force an update, as was mentioned in the article, and re-ran the scripts - the mod date was then 3 June (it's 4 June here), but the version number was now 4.

If I hadn't forced the update, I'd still be at version 1 of the updates, 1st June. The question is - why is it not auto-updating like it's supposed to? Is it because I have 'Open Safe Files' off that it doesn't download the update when I use the iMac / Safari? Or is the update mechanism independent of Safari?

Also, is this security update only Safari-oriented, and not machine global in its application? Does it function if you use other browsers like Firefox?

Same problem here. (That's why I wrote the script).
I guess you're not logged in as an admin all the time? Updates seem to be prevented by this.

I already filled a bugreport. But you should do that as well, so they might notice this is a real issue.
-> bugreport.apple.com/

I have posted a very quick-and-dirty shell script that incorporates the above hint, but also forces XProtect to update itself:

<http://dl.dropbox.com/u/20247393/UpdateXProtect.zip>

The archive contains the shell script as well as the script enclosed in a Platypus wrapper. I stole the app's icon from somewhere linked by Google Images, and it's used it without permission. Don't sue me.

Three users have reported completely losing their login.keychain immediately after using this tool to manually update their XProtect defs. I don't see any way that it could directly cause this, it could well be the XProtect process itself, but I am more inclined to think the sudo process when checking for an admin password. It could also be a corrupt keychain and a user who has never issued a sudo command.

In any case I recommend what I understand Apple is telling users who are not getting automatic updates, to uncheck and recheck the "Automatically update safe downloads list" box in the Security Preferences Panel. Rebooting works for some, but not all users.

i like scripting as much as the next guy, so i played around a little making the shell script a little simpler, but i ended up with this:

cat /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

imho, there's not much reason to do more (for the informational script, i mean).

discuss \(^;^)/

Very nice!