Sunday, May 27, 2012

com.apple.quarantine

If you are like me, you may have gotten annoyed in both Windows and Mac OS X by the warning window.

Mac OS X Example Screenshot

These warnings come from a metadata source that the OS is evaluating. On Windows, Microsoft uses a NTFS feature called Alternate Data Streams. In Windows when you open the file you get a warning...You can click OK and the ADS will remain, or you can uncheck the box "Always ask before opening this file". Unchecking that box and clicking Open/Run will delete the ADS which tells Windows that this file was downloaded from a network location. For more details on the ADS associated with a file, and/or to delete the ADS check out the Sysinternals Streams tool.


In Mac OS X, Apple uses a feature called extended Attributes. You can see that a file has extended attributes via the List Long output (ls -l) and looking for the at (@) symbol.

I downloaded synergy 1.4.8 from http://synergy-foss.org/ as an example
user:~$ ls -l synergy-1.4.8-MacOSX107-x86_64.dmg
-rw-r--r--@ 1 user group 13783645 Apr 25 17:42 synergy-1.4.8-MacOSX107-x86_64.dmg
Now let's see what Extended Attributes are associated with this file.

user:~$ xattr synergy-1.4.8-MacOSX107-x86_64.dmg
com.apple.metadata:kMDItemWhereFroms
com.apple.quarantine

Note: When opening the Disk Image we do not get a warning, however, some of the attributes follow any file copied from the Disk Image. Also, new attributes are added after opening thanks to some checks performed on Mac OS X. Just Notes, I haven't looked into these other items.

I extracted the Synergy.App so that I can use it to example the filewarning

user:~$ xattr Synergy.app/
com.apple.quarantine

If you do not want to receive this warning we need to remove (delete) the Extended Attribute com.apple.quarantine

user:~$ xattr -d com.apple.quarantine Synergy.app/
user:~$ xattr Synergy.app/
#Note: No Output since the one attribute was removed.
user:~$

When I am working with a large amount of data downloaded for tech-support purposes, and I trust the source, I will tend to remove this attribute manually from the Terminal just so that I don't have any trouble with any files not opening.

user:~$ xattr -rd com.apple.quarantine folder/

I hope this helps others dealing with there Mac and improves our knowledge. Thanks to this Macworld Article as the stepping stone to my understanding of Extended Attributes.
http://www.macworld.com/article/1145324/filewarnings.html

2 comments:

BlauerPlums said...

Thanks a ton. Your instructions really helped me bypass gatekeepers block on a program. It turns out that some programs can't even be opened when you right-click on them and chose "open". Tells you something about it being "damaged" and it needs to be moved to "trash". Anyways, I also want to note that having "spaces" in your programs name can be problematic but after removing those, it works like a charm. I really like your instruction how to check the associations of a program with the command: >xattr /

That really helped. Thanks a lot.

Craig Lorentzen said...

Glad I could help BlauerPlums...I try to log everything I figure out in a new OS so that at least I can refer to it later and so that others can learn as well.