What is qemu-system-x86_64 from launchd and why does it want to "accept incoming network connections"?

Question

I had this pop up unexpectedly (MacOS Ventura 13.5.1, Intel i7 MacBook Pro):

Do you want the application “qemu-system-x86_64” to accept incoming network connections?

No recent updates or new software that I'm aware of, not running any applications I haven't used every day for months

Based on this different question I looked in ActivityMonitor and it seems qemu-system-x86_64 is being run by launchd(1) via kernal_task (1) via kernal_task (0):

So, it seems like a legit internal system process, I just don't understand why it would suddenly need to accept incoming connections, or why it doesn't have all the permissions it needs out of the box.

user56reinstatemonica8 · Accepted Answer · 2023-11-15T10:47:02.593

I figured it out:

In ActivityMonitor, if the "Parent process" doesn't offer clues as to why something is running, using the "Sample" button then digging through the output can give clues.
In my case, qemu was hosting a legitimate Android emulator I hadn't realised was still running in the background
Apparently unexpected "incoming connections" dialogs are not uncommon in recent MacOS versions and are usually caused by some change to the application's signature

I tried the ActivityMonitor "Sample" button as suggested in this forum thread (apparently that user's qemu was hosting miner malware from a bad torrent ).

In the sample output, I saw a lot of references to dylib and some to android like this:

    +   1560 _pthread_start  (in libsystem_pthread.dylib) + 125  [0x...8037ae1d3]
    +     1560 android::base::Thread::thread_main(void*)  (in libandroid-emu-metrics.dylib) + 155  [0x...c674b]
    +       1560 std::__function::__func<android::base::FunctorThread::FunctorThread<void (*)(), void*>(void (*&&)(), android::base::ThreadFlags)::'lambda'(), long ()>::operator()()  (in qemu-system-x86_64) + 7  [0x...2e0cd7]

A little digging around found an old Android emulator was running in the background, and it was using qemu-system-x86_64 presumably to emulate the Android OS architecture. Closing the emulator made qemu-system-x86_64 disappear from ActivityMonitor.

This particular emulator must have been sat in the background untouched for at least a few weeks, so I still don't understand why its need for "incoming network connections" permissions would have changed today, but at least I know why it was running at all.

Looking at my Firewall settings under Network in system settings, it had apparently already been granted access to incoming connections previously, so it's odd that it decided to ask again today. However, looking at the many other questions and threads complaining about unexpected "accept incoming connections" dialogs I suspect this is common and not cause for concern, probably caused by some small under-the-hood update or expiration.

What is qemu-system-x86_64 from launchd and why does it want to "accept incoming network connections"?

1 Answers1