Weird remotedesktop folder in usr/local - safe? While doing some cleanup of old files on my Mac (macOS 10.12.4, having updated a few days ago) I just discovered a weird file I couldn't find any information on.

In usr/local, there is a folder called remotedesktop with a RemoteDesktopChangeClientSettings.pkg file inside.

drwxr-xr-x  3 root  wheel  102  6 Mär 20:10 remotedesktop
drwxr-xr-x  3 root  wheel  102  6 Mär 20:10 RemoteDesktopChangeClientSettings.pkg


While I know that remote desktop clients have many legitimate use cases, I am a bit worried where this is coming from since I've never used any on this machine.

Is this file a regular part of the OS or a vendor file that was placed there? Should I try and open it?
To determine the origin you have several tools at hand:


Code signing. Check the code signing of the app/pkg:

codesign -dv --verbose=4 /usr/local/remotedesktop/RemoteDesktopChangeClientSettings.pkg 


This yields the following:

Executable=/usr/local/remotedesktop/RemoteDesktopChangeClientSettings.pkg/Contents/Info.plist
Identifier=com.apple.pkg.RemoteDesktopChangeClientSettings
Format=installer package bundle
CodeDirectory v=20100 size=176 flags=0x0(none) hashes=1+3 location=embedded
Hash type=sha1 size=20
CandidateCDHash sha1=888c8c6a6abd2f544020594e7d6f4dc31a7e01b8
Hash choices=sha1
CDHash=888c8c6a6abd2f544020594e7d6f4dc31a7e01b8
Signature size=4072
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Info.plist entries=24
TeamIdentifier=not set
Sealed Resources version=2 rules=12 files=21
Internal requirements count=1 size=96


Seems legit and (comparing it to other apps) from Apple itself. If the app/pkg was signed by another company at least one of the Authority lines would show a different vendor/developer.
Check the receipt bom files:

grep --include=\*.bom -rnw '/System/Library/Receipts/' -e "RemoteDesktopChangeClientSettings"


which will probably yield:

Binary file /System/Library/Receipts//com.apple.pkg.RemoteDesktopClient.bom matches


Check the corresponding plist file and you will get the installer package: RemoteDesktopClient 3.9.2. Seems also legit Apple.
Now you can lsbom ... the file. See man lsbom.

A second Receipts folder with non-Apple boms/plists is in the /Library folder!




There are probably some more methods to check if the file is legit or not which I'll try to add later.