PSA: Google Chrome Updater/Keystone rendering Macs/Hacks with Disabled SIP Unbootable

[maleorderbride]

I was't sure what forum to post this under, but after a frustrating day of working on this problem I thought I could save someone else that irritation.

 

As the title says, this affects any computer running with SIP disabled and 10.14 or lower. It seems pretty clear that the Google Updater is responsible, and that usually installs silently alongside all Google products.

 

I identified two workarounds that I was doing all morning, but thankfully the guys in MacAdmins on slack found the root case: Google's Keystone Updater.

You can read some about this here: https://mrmacintosh.com/google-chrome-keystone-is-modifying-var-symlink-on-non-sip-macs-causing-boot-issues/?fbclid=IwAR34Mdudrhv7QgI8gYIyrryz6pS__bcFJESXBTG-X6RI_IrFDhbv0JPgYbY

Presumably Google will fix this (the issue has been live for ~30 hours now), but you can either re-enable SIP (set to 0x00), or give the Google Updater the axe. I also have fixes documented below if you currently can't boot. This issue can happen on 10.14 and below, if you currently use, or have in the past, a Google product (like Chrome).

 

If you are already affected you can re-install non-destructively on top from Recovery HD, or boot into single user and re-link /var and /private/var:

1. Boot single user
2. sbin/fsck -fy 
3. sbin/mount -uw /
4. 'ln -s private/var var'

 

If you don't know if you are affected then check in Users & Groups and see if you are still an administrative user. If you aren't then rebooting will lead to a kernel panic.

 

If you are not affected, then you have two options.

1. Enable SIP by editing your config.plist and changing CsrActiveConfig to 0x00 (usually from 0x67).
2. Remove Google Software Update and set the folder so it does not have permission to re-install itself (hopefully):

sudo rm -R ~/Library/Google/GoogleSoftwareUpdate/

sudo touch ~/Library/Google/GoogleSoftwareUpdate

sudo chmod 444 ~/Library/Google/GoogleSoftwareUpdate

sudo rm ~/Library/LaunchAgents/com.google.keystone.agent.plist

sudo rm -R ~/Library/Caches/com.google.Keystone*

sudo rm ~/Library/Preferences/com.google.Keystone.Agent.plist

Edited September 24, 2019 by maleorderbride

[maleorderbride]

Google has rolled back the update, so everything should be fine now.