login: login: Could not determine audit condition

Question

I got stuck with the process completion window of Mac terminal. Restarting Terminal, rebooting Mac, nothing working. Whenever I open terminal it shows the same window and I cannot write on it. How to resolve it?

Solution 1

I recently had my MacOS (Sierra 10.12.3) Terminal greet me with ..

   login: Could not determine audit condition

   [Process completed]

.. after I messed with my usr/bin permissions.

After a lot of trial and error I fixed it by deleting the FILE (not folder) called 'login', which is in /usr/bin.

I make a point to stress that it's not a folder but a file, because prior to Sierra there was a folder called usr/bin/login, whose deletion fixed some permission issues causing Terminal failures.

On MacOS Sierra the folder has been removed, but deleting the 'login' file (or moved it someplace else) solved my problem, and my machine works fine.

Good luck!

Solution 2

Deleting usr/bin/login worked for me as well but it did have side effects (I later noticed that some ENV variables were missing that were presumably dependent on the login file). The problem was coming from the permissions So I did the following:

• renamed the login file to sth else so terminal would work again
• started another terminal instance
• reverted the name change (and kept the working terminal instance open)
• in the working terminal:
  • "sudo chown root:wheel /usr/bin/login"
  • "sudo chmod 4755 /usr/bin/login"

Then it all went back to normal.

Solution 3

The other answer to this problem fairly bizarre and the solution to this is most certainly not to just go and delete the login file.

Not only is the directory where that file is found protected by System Integrity Protection preventing this from being possible as described, but the login file is not just some auto-regenerated plist file, its a mach-o executable and the code that is needed to log any user in.

The issue is not even login causing a problem as indicated by the error message login is running into that mentions audit aka the Basic Security Module which logs security events and also takes actions for example terminating a process or even halting the OS should some variable occur.

The solution is to simply repair permissions. Since Disk Utility includes that option in a way that addresses this issue you'll have to sort of trick the Terminal into this:

1. Go to the Preferences page in Terminal
2. Find the "Shells open with:" item on the General tab
3. Select the "Command (complete path)" option
4. Enter the following in the space provided:

sudo /usr/sbin/diskutil resetUserPermissions /dev/disk1s1 501

5. Open a new Terminal tab or window
6. Enter your password and allow the process to complete
7. Open a new tab or window to verify success

Note: You'll need to enter the correct mount point which may not be /dev/disk1s1 and the correct UID for your current user which may not be 501 but these are both the most likely possibilities.