MacOS Sophos updates failing - you don’t have permission to access “CID”

We have an increasing number of devices that are outdating. While we cannot really see issues on the endpoints, and Central shows most of the Macs as nice and green,

deeper in the Central logs we see a bunch of strange update errors like:

Low,"2024-08-21T10:03:27+02:00","Download of MacEndpoint failed from server TreeVisitor failed: path does not exist: /Library/Caches/com.sophos.sau/CID."

"2024-08-21T09:26:19+02:00","Download of MacEndpoint failed from server “Sophos Installer” couldn’t be moved because you don’t have permission to access “CID”.."

Low,"2024-08-21T08:46:59+02:00","Download of MacEndpoint failed from server Could not verify any signatures: refusing to load unverified content."

Low,"2024-08-21T07:37:09+02:00","Failed to download updates."

Low,"2024-08-20T08:47:39+02:00","Download of MacEndpoint failed from server The operation couldn’t be completed. (com.sophos.macendpoint.sdds3 error 6001.)."

Low,"2024-08-19T13:36:47+02:00","Download of MacEndpoint failed from server sdds3.sophosupd.com/.../sdds3.ScheduledQueryPack.dat: 0."

The first time this error appeared was on July 19th on one device. Others followed. Now we have 6 devices with that status.

Low,"2024-07-19T06:02:26+02:00","Download of MacEndpoint failed from server “Sophos Installer” couldn’t be moved because you don’t have permission to access “CID”.."

What's going on here? What does CID mean? TreeVisitor??

What can we actually do?

One Mac as example:

Added tags
[edited by: GlennSen at 2:24 PM (GMT -7) on 3 Sep 2024]

Top Replies

Qoosh 2 months ago in reply to LHerzog +1

I was able to find this article, which mentions the same error code you spotted in the logs. It suggests rebooting the device in question to refresh the JWT (JSON Web Token). - Sophos Central Endpoint…

Parents

0 Rutvik Chavda 3 months ago

Hello, LHerzog

We appreciate your reaching out to the Sophos Community Forum.

It’s possible that the OS revoked the security permission after the update. Please ensure the required permissions are still in place and grant if needed. Please refer to this for further information and instructions:

Security permissions on macOS - Sophos Central Admin

https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/ProtectDevices/EndpointProtection/MacSecurityPermissions/

Check security permissions on macOS - Sophos Central Admin

https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/ProtectDevices/EndpointProtection/MacCheckSecurityPermissions/

Regards,

Rutvik Chavda

Global Digital Endpoint Security Engineer

Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts

If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 3 months ago in reply to Rutvik Chavda

Thanks for the doc links you provided Rutvik Chavda

I don't like the idea that these permissions may change at random - but in fact they do (we've had that in the past on many devices).

Though I'd expect if the permissions are wrong, we'd have a red X at sophosscand on the status in Central and not all green.

Like this:

The computer I picked initially on my first poth has all green and displayed no issues, just the update failed logs were showing the problem.

But we'll check that on the endpoints locally and report back.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 LHerzog 3 months ago in reply to LHerzog

 sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' | grep -i sophos
 
kTCCServiceSystemPolicyAllFiles|com.sophos.SophosScanAgent|0|2|4|1|��
                                                                     ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.macendpoint.CleanD|0|2|4|1|��
                                                                        ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.macendpoint.SophosServiceManager|0|2|4|1|��
                                                                                        ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.liveresponse|0|2|4|1|��
                                                                  ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.endpoint.uiserver|0|2|4|1|��
                                                                       ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.SDU4OSX|0|2|4|1|��
                                                             ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|/Library/Sophos Managed Detection and Response/SophosMDR|1|2|4|1|��
         ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.endpoint.scanextension|0|2|4|1|��
                                                                              ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.livequery|0|0|5|1|��
                                                               |||UNUSED||0|1654025980|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.scan|0|2|4|1|��
                                                            ||0|UNUSED||0|1654072710|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.SophosEncryptionCentralAdapter|0|0|5|1|��
                                                                                        |||UNUSED||0|1666866485|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.SophosEncryptionD|0|0|5|1|��
                                                                           |||UNUSED||0|1666866510|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.preferences|0|0|5|1|��
                                                                     |||UNUSED||0|1691503011|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.updater|0|0|5|1|��
                                                             |||UNUSED||0|1699170796|||UNUSED|0

/Library/Application Support/com.apple.TCC/MDMOverrides.plist: No such file or directory

Reply

0 LHerzog 3 months ago in reply to LHerzog

 sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' | grep -i sophos
 
kTCCServiceSystemPolicyAllFiles|com.sophos.SophosScanAgent|0|2|4|1|��
                                                                     ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.macendpoint.CleanD|0|2|4|1|��
                                                                        ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.macendpoint.SophosServiceManager|0|2|4|1|��
                                                                                        ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.liveresponse|0|2|4|1|��
                                                                  ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.endpoint.uiserver|0|2|4|1|��
                                                                       ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.SDU4OSX|0|2|4|1|��
                                                             ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|/Library/Sophos Managed Detection and Response/SophosMDR|1|2|4|1|��
         ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.endpoint.scanextension|0|2|4|1|��
                                                                              ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.livequery|0|0|5|1|��
                                                               |||UNUSED||0|1654025980|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.scan|0|2|4|1|��
                                                            ||0|UNUSED||0|1654072710|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.SophosEncryptionCentralAdapter|0|0|5|1|��
                                                                                        |||UNUSED||0|1666866485|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.SophosEncryptionD|0|0|5|1|��
                                                                           |||UNUSED||0|1666866510|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.preferences|0|0|5|1|��
                                                                     |||UNUSED||0|1691503011|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.updater|0|0|5|1|��
                                                             |||UNUSED||0|1699170796|||UNUSED|0

/Library/Application Support/com.apple.TCC/MDMOverrides.plist: No such file or directory

Children

0 Michael Heider 2 months ago in reply to LHerzog

I had the same problem and soved it. Please check your permissions for hard disk usage, see screenshot. Mine was de-activated after the last macOS update. With activating this my updates are working now.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 2 months ago in reply to Michael Heider

Hi Michael Heider and thanks for your answer. I'll ask one of the users to check that.

I wonder what Rutvik Chavda says to the permissions report I posted above.

I'ts unclear to me what the results mean.

From your screenshot I translate this would be the line from the report:

kTCCServiceSystemPolicyAllFiles|com.sophos.updater|0|0|5|1

but, what is 0 0 5 1 ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 2 months ago in reply to LHerzog

I've got feedback that at least some of the permissions were not allowed any more.

I hate that the Sophos Endpoint is not able to show a visible warning to the user, that something important like that is misconfigured.

allowing it again, fixes the update problem.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 2 months ago in reply to LHerzog

Rutvik Chavda can you please tell what the expected output of the report is and what those numbers mean?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Rutvik Chavda 2 months ago in reply to LHerzog

Hello, LHerzog

We appreciate your reaching out to the Sophos Community Forum.

I have checked this. The updated version from Sophos, which is expected to be released at the end of next week, will fix the permission issue.

Regards,

Rutvik Chavda

Global Digital Endpoint Security Engineer

Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts

If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 2 months ago in reply to Rutvik Chavda

sounds good - but I'm afraid eventually only until the next MacOS release
too bad, Apple is not caring much about 3rd party AV vendors.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Qoosh 2 months ago in reply to LHerzog

I was able to find this article, which mentions the same error code you spotted in the logs. It suggests rebooting the device in question to refresh the JWT (JSON Web Token).
- Sophos Central Endpoint for Mac: Download of MacEndpoint failed from server

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 2 months ago in reply to Qoosh

thanks for the KB - it may help. we'll see if we're still having the JWT (which was only one of severals issues)
Cancel
Vote Up -1 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 1 month ago in reply to LHerzog

fyi today there is a big notification in Sophos Central warning about Update Issues on MacOS

support.sophos.com/.../KBA-000009916
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LHerzog 1 month ago in reply to LHerzog

thanks for this new notification

Sophos Updater doesn't have Full Disk Access and won't be able to update until it does.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel