syspolicyd using high CPU on a Mac: Gatekeeper at work
syspolicyd is Gatekeeper: it checks apps and code before they run. Developers see it spike after builds. It used 0.6% to 1.4% on our Mac. What sets it off.
What is syspolicyd?
syspolicyd is the process behind Gatekeeper. Before an app, script or command line tool runs for the first time, it checks the signature and notarization, and asks Apple's servers when it needs to. It lives at /usr/libexec/syspolicyd and runs as root.
On our Mac it used 0.6% to 1.4% CPU and between 6 and 42 MB across samples.
Why is syspolicyd using so much CPU?
- Developer builds: every freshly built binary is new to Gatekeeper. Test runs that build and launch many binaries keep it busy.
- Installers and downloads: a large app checked on first launch, or many tools unpacked at once.
- Slow notarization checks: on a slow or filtered network, checks take longer.
Can I turn it off?
You can stop Gatekeeper's checks for developer tools only. Add your terminal app under System Settings, Privacy & Security, Developer Tools, and code you run from it is not checked the same way. That is the setting meant for developers; switching Gatekeeper off entirely is not, and it is not worth the risk.
See it live
Free Mac's System tab ranks every process by processor use and energy impact, once a second, and marks the ones macOS will not let you quit as protected. See also trustd and tccd.
Related: logd high CPU and locationd.
Common questions
What is syspolicyd on a Mac?
The Gatekeeper process. It checks apps and code for a valid signature and notarization before they first run.
Why is syspolicyd using high CPU?
Something new is running for the first time: developer builds, installers or many downloaded tools.
How do I stop syspolicyd slowing my builds?
Add your terminal app in System Settings, Privacy & Security, Developer Tools.