Apple Persistent State Encryption in Keychain

[MaiKAimer]

I was looking around in my Keychain Access App in the past few days and I noticed a weird phenomenon that the login item Apple Persistent State Encryption can randomly become unrestricted. Normally, every time I login to my account a new item of Apple Persistent State Encryption is created, with access set to "confirm before allowing access" and default access belongs to "talagent", and it is frequently modified (I guess it's normal system behaviour).

However, sometimes when I leave my M1 Macbook on for days, I notice occasions that the item Apple Persistent State Encryption access suddenly becomes "allow all applications to access this item" and remains such way until my next login. Is this behaviour intended by the system? From my best guess based on its description the password for Apple Persistent State Encryption is pretty confidential and should not be open for access by default. I am also not aware of any popup request asking for Keychain Access throughout my entire usage nor any abnormality. Any chance my Mac is compromised?

I didn't modify anything in Keychain Access and I was just observing what was there.

Any advice would be appreciated.

 

[NoBoMac]

Mac is not compromised. Normal behavior. Key snippet from the man page for talagent:

-refresh_encryption

Rotates the bitmap encryption key, and attempts to cross-encrypt all existing window bitmaps under the new key. This is done periodically by talagent.

Basically, talagent stops/pauses/starts applications that are idle/inert so that other apps can use the resources of the "dead" apps. And it is encrypting items saved to disk and using Keychain to do its job.

On a related note, and not sure if totally relevant in regards to talagent, there a number of keychain items that are "unlocked" once the machine has been started and a user logged in on M Macs as their security model is very similar to iOS devices.

Data Protection classes

Apple controls Data Protection in Apple devices by assigning each file to a class.

support.apple.com