https://eclecticlight.co/2023/03/13/ventura-has-changed-app-quarantine-with-a-new-xattr/ Skip to content [eclecticlight] The Eclectic Light Company Macs, painting, and more Main navigation Menu * Downloads * M1 & M2 Macs * Mac Problems * Mac articles * Art * Macs * Painting hoakley March 13, 2023 Macs, Technology Ventura has changed app quarantine with a new xattr Now that we're approaching half time in Ventura's cycle, it's good that we're still discovering new features that Apple forgot to mention at WWDC last June. This article outlines how macOS 13 has changed the process of app quarantine, with the addition of a new extended attribute to track the origin of quarantined apps in their provenance. Clearing quarantine What used to happen when a file was downloaded using Safari or another app that supports quarantine, was that an extended attribute of type com.apple.quarantine was added to the downloaded file. This contains the quarantine flag itself, indicating whether it's set or has been cleared, the time of its attachment, the app or agent that attached the flag, and a UUID reference to an entry in the QuarantineEvents database at ~/Library/Preferences/ com.apple.LaunchServices.QuarantineEventsV2. When that app was run for the first time and underwent Gatekeeper's full checks, if it was accepted, the quarantine flag was changed to indicate the app was no longer quarantined, and future launches of that app didn't undergo full first run checks. For instance, the normal quarantine flag attached when a file transits AirDrop is 0081, and when that's cleared it becomes 00c1. Other than that changed extended attribute, there seems to be no record kept of the clearance of that flag. Provenance What happens in macOS Ventura is essentially the same until the moment that quarantine is cleared, when macOS now attaches a new extended attribute (xattr) of type com.apple.provenance to the file. This contains an 11-byte binary reference unique to that quarantine event, and may be protected by SIP to make it persist and prevent it from being stripped. xattr01 For example, when an app is transferred between Macs using AirDrop, any existing com.apple.quarantine xattr is replaced with a new one with its flag is set to 0081. When that app is successfully opened on the recipient Mac, and its quarantine flag is changed to 00c1, an 11-byte com.apple.provenance xattr is added and SIP may be applied to it to prevent its removal. Some early releases of Ventura appear to have been more thorough in applying the com.apple.provenance xattr, and have added it to every folder and file within an app when it was taken out of quarantine; in that situation, the 11-byte identifier is identical across all files and folders taken out of quarantine in that app. Behaviour in macOS 13.2.1 currently appears limited to attaching just a single com.apple.provenance xattr to the .app folder. You may also come across apps in which the original com.apple.quarantine xattrs have been stripped, leaving just the protected com.apple.provenance xattrs behind. xattr02 Removal Defeating any SIP protection is simple for the user: when an app with a protected com.apple.provenance xattr is copied to another volume, the SIP protection breaks, and the xattr can be deleted in the normal way. However, code that tries to remove that xattr while it's still protected may fail, and that has resulted in problems reported in Ventura by some users. Unlike the other com.apple.macl xattr that can be attached to any file as part of TCC's privacy protections, and is also protected by SIP, com.apple.provenance should only ever be attached to apps and their contents. It always seems to be just 11 bytes in size, although in one case rose to 4096 bytes through trailing padding with zeros, presumably as the result of an error on the part of macOS. xattr03 The purpose and use of the com.apple.provenance xattr is currently unknown, and appears to be still evolving. I'd be very interested to hear of other evidence of its behaviour and use in quarantine. Summary * Ventura introduces a new extended attribute com.apple.provenance, attached to apps when they clear quarantine. * The xattr contains binary data of 11 bytes that is unique to that quarantine event. * The xattr is protected by SIP, so can't be removed unless the app is copied to another volume. * It's otherwise undocumented, and its purpose and use are unknown. GUI access to xattrs and the crawler used above are features of my free utility xattred. Postscript I'm very grateful to Randy Saldinger of Mothers Ruin for pointing out that SIP isn't always applied to the com.apple.provenance xattr. I'm not sure whether this only occurs in certain circumstances, or in earlier versions of Ventura, but has been a previous cause of complaint about this xattr. Randy has also identified the binary content of this new xattr as containing an 8-byte integer that is that app's primary key in the provenance_tracking table in /var/db/SystemPolicyConfiguration/ ExecPolicy. This would enable macOS to check the previous cdhash and other information about the app, perhaps to determine whether fuller checks are required by Gatekeeper, when the app is launched on subsequent occasions. That would make it a key part of Ventura's new extended Gatekeeper checks. Please read Randy's comments below for further information. Share this: * Twitter * Facebook * Reddit * Pinterest * Email * Print * Like this: Like Loading... Related Posted in Macs, Technology and tagged com.apple.provenance, extended attributes, macOS 13, quarantine, security, Ventura, xattr, xattred. Bookmark the permalink. 11Comments Add yours 1. 1 [523738605456] Randy Saldinger on March 13, 2023 at 5:09 pm Reply Oh, that's an interesting find! It looks like the last 8 bytes of this xattr value is a (Little Endian) integer value that connects to the "pk" (primary key) column of the "provenance_tracking" table in /var/db/SystemPolicyConfiguration/ExecPolicy. This table contains the cdhash, bundle identifier, team ID and some other bits about the app. I'd suspect this is used somehow to decide when an app has been modified and thus requires a full code signature validation of all resources (which can't possibly be happening on every app launch, since it would never be performant enough). But how exactly, I don't know... LikeLiked by 1 person + 2 [6986a746f627] hoakley on March 13, 2023 at 5:12 pm Reply Thank you - an excellent catch there too. The pieces are starting to fit together. Howard LikeLike o 3 [523738605456] Randy Saldinger on March 13, 2023 at 5:29 pm Reply By the way, I'm not seeing the com.apple.provenance xattr as protected on macOS 13.2.1 (22D68). I can delete it readily with "xattr -d" -- the command succeeds and ls -l@ shows it as gone. It doesn't seem to come back, even after a reboot (as com.apple.macl wants to do?). I absolutely have SIP enabled, so that's a bit baffling. LikeLiked by 1 person # 4 [6986a746f627] hoakley on March 13, 2023 at 6:07 pm Thank you. I haven't tried every instance of the xattr, but those that I tried to delete wouldn't, and it has been complained about by other users. I'll try taking a look to see when SIP is being applied, and when it isn't. I think what you're seeing with com.apple.macl is that the initial delete worked for a second or two, but the xattr is rapidly restored and SIP reapplied. It looks weird in xattred: you can cut the macl xattr, but it bounces back every time, unless the file has been transited through another volume, when it loses SIP of course. Howard. LikeLike 2. 5 [9a1b7722249e] dominikushoffmann on March 13, 2023 at 7:58 pm Reply I found that I was able to use xattr -d com.apple.quarantine on a Mac mini (Intel) running Ventura to stop the OS from asking me about whether I wanted to really open the app every single time I launched it. Was that, because it was a Mac without a T1 or T2 chip? LikeLiked by 1 person + 6 [6986a746f627] hoakley on March 13, 2023 at 10:24 pm Reply No. The com.apple.quarantine flag has never been protected. Indeed, some very respectable (cough, cough) software strips it. However, what should happen is that, once that app has been run first time, the flag should be set as being cleared, but not removed from the app. I'm not sure why yours isn't - that's the abnormal behaviour here. Howard. LikeLike 3. 7 [eabf75208318] Jeff on March 13, 2023 at 9:54 pm Reply I saw this attribute after I created a signed installer package. I haven't seen any developer documentation for it so I was wondering what it was for as well. Thank you for peeling off the first layer of the mystery. LikeLiked by 1 person + 8 [6986a746f627] hoakley on March 13, 2023 at 10:24 pm Reply Thank you. Howard. LikeLike 4. 9 [daba689ce91c] Pico on March 13, 2023 at 9:59 pm Reply Very interesting find, thanks for sharing this info! One small but important distinction though is that it appears "com.apple.macl" and "com.apple.provenance" are protected by TCC rather than SIP. Things that are protected by SIP cannot be altered even by processes that have been granted Full Disk Access TCC permissions, but these extended attributes can be deleted by processed that have been granted FDA. While I believe technically TCC is part of the whole SIP umbrella, things directly protected by SIP are much more locked down by the system vs TCC protected things that just need explicit user permissions. LikeLiked by 1 person + 10 [6986a746f627] hoakley on March 13, 2023 at 10:33 pm Reply Thank you, Pico. You've just opened another can of worms! When com.apple.macl was first discovered by Jeff Johnson back in Catalina, he discovered it was protected by SIP, and all my prior experience with it is that it has been since then. I normally give my app xattred FDA, but it can't strip macl xattrs until they've been passed through another volume to disable the SIP. And my Mac Studio running 13.2.1 behaves like that too. However, I've now noticed that my iMac Pro, also running 13.2.1, can strip macl xattrs with only FDA enabled. I cannot explain the difference, but the Studio definitely has given xattred FDA. I'm not so convinced now that the provenance xattr is currently protected by either TCC or SIP. However, I have some apps that gained it earlier in Ventura, and the xattr is still sticky on them. I also have a couple of apps where, instead of just attaching to the .app folder, every single file in the bundle has got a provenance xattr attached. So I suspect that its behaviour has changed since the first beta of Ventura, and may continue to change. The good thing is that I have now tracked this behaviour down in the log, so it's going to be much easier to keep track of its behaviour, so long as the log entries continue. Howard. LikeLike o 11 [daba689ce91c] Pico on March 13, 2023 at 10:47 pm Reply There may be more pieces to the puzzle, but it looks like maybe what is protecting the extended attributes on apps in Ventura is the new "App Management" TCC permission. I only did one quick test with only granting Terminal "App Management" instead of FDA but was then able to remove all xattrs using "xattr -c" including "com.apple.macl" and "com.apple.provenance" on a newly downloaded app that had been opened once. So, some kinds of TCC protection seems at play here, but it could either have to do with general app protections, or maybes with the specific xattrs but it's hard to say without more investigation and also knowing exactly what these TCC permissions are programmed to allow. LikeLiked by 1 person Leave a Reply Cancel reply Enter your comment here... [ ] Fill in your details below or click an icon to log in: * * * * Gravatar Email (required) (Address never made public) [ ] Name (required) [ ] Website [ ] WordPress.com Logo You are commenting using your WordPress.com account. ( Log Out / Change ) Twitter picture You are commenting using your Twitter account. ( Log Out / Change ) Facebook photo You are commenting using your Facebook account. ( Log Out / Change ) Cancel Connecting to %s [ ] Notify me of new comments via email. [ ] Notify me of new posts via email. [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] This site uses Akismet to reduce spam. Learn how your comment data is processed. Quick Links * Downloads * Mac Troubleshooting Summary * M1 & M2 Macs * Mac problem-solving * Painting topics * Painting * Long Reads Search Search for: [ ] [Search] Monthly archives * March 2023 (31) * February 2023 (68) * January 2023 (74) * December 2022 (74) * November 2022 (72) * October 2022 (76) * September 2022 (72) * August 2022 (75) * July 2022 (76) * June 2022 (73) * May 2022 (76) * April 2022 (71) * March 2022 (77) * February 2022 (68) * January 2022 (77) * December 2021 (75) * November 2021 (72) * October 2021 (75) * September 2021 (76) * August 2021 (75) * July 2021 (75) * June 2021 (71) * May 2021 (80) * April 2021 (79) * March 2021 (77) * February 2021 (75) * January 2021 (75) * December 2020 (77) * November 2020 (84) * October 2020 (81) * September 2020 (79) * August 2020 (103) * July 2020 (81) * June 2020 (78) * May 2020 (78) * April 2020 (81) * March 2020 (86) * February 2020 (77) * January 2020 (86) * December 2019 (82) * November 2019 (74) * October 2019 (89) * September 2019 (80) * August 2019 (91) * July 2019 (95) * June 2019 (88) * May 2019 (91) * April 2019 (79) * March 2019 (78) * February 2019 (71) * January 2019 (69) * December 2018 (79) * November 2018 (71) * October 2018 (78) * September 2018 (76) * August 2018 (78) * July 2018 (76) * June 2018 (77) * May 2018 (71) * April 2018 (67) * March 2018 (73) * February 2018 (67) * January 2018 (83) * December 2017 (94) * November 2017 (73) * October 2017 (86) * September 2017 (92) * August 2017 (69) * July 2017 (81) * June 2017 (76) * May 2017 (90) * April 2017 (76) * March 2017 (79) * February 2017 (65) * January 2017 (76) * December 2016 (75) * November 2016 (68) * October 2016 (76) * September 2016 (78) * August 2016 (70) * July 2016 (74) * June 2016 (66) * May 2016 (71) * April 2016 (67) * March 2016 (71) * February 2016 (68) * January 2016 (90) * December 2015 (96) * November 2015 (103) * October 2015 (119) * September 2015 (115) * August 2015 (117) * July 2015 (117) * June 2015 (105) * May 2015 (111) * April 2015 (119) * March 2015 (69) * February 2015 (54) * January 2015 (39) Tags APFS Apple AppleScript Apple silicon backup Big Sur Blake bug Catalina Consolation Console diagnosis Disk Utility Dore El Capitan extended attributes Finder firmware Gatekeeper Gerome HFS+ High Sierra history of painting iCloud Impressionism iOS landscape LockRattler log logs M1 Mac Mac history macOS macOS 10.12 macOS 10.13 macOS 10.14 macOS 10.15 macOS 11 macOS 12 macOS 13 malware Mojave Monet Monterey Moreau MRT myth narrative OS X Ovid painting Pissarro Poussin privacy realism Renoir riddle Rubens Sargent scripting security Sierra SilentKnight SSD Swift symbolism Time Machine Turner update upgrade Ventura xattr Xcode XProtect Statistics * 14,088,824 hits Blog at WordPress.com. Footer navigation * About & Contact * Macs * Painting * Language * Tech * Life * General * Downloads * Mac problem-solving * Extended attributes (xattrs) * Painting topics * Hieronymus Bosch * English language * LockRattler: 10.12 Sierra * LockRattler: 10.13 High Sierra * LockRattler: 10.11 El Capitan * Updates: El Capitan * Updates: Sierra, High Sierra, Mojave, Catalina, Big Sur * LockRattler: 10.14 Mojave * SilentKnight, silnite, LockRattler, SystHist & Scrub * DelightEd & Podofyllin * xattred, Metamer, Sandstrip & xattr tools * 32-bitCheck & ArchiChect * T2M2, Ulbow, Consolation and log utilities * Cirrus & Bailiff * Taccy, Signet, Precize, Alifix, UTIutility, Sparsity, alisma * Revisionist & DeepTools * Text Utilities: Nalaprop, Dystextia and others * PDF * Keychains & Permissions * LockRattler: 10.15 Catalina * Updates * Spundle, Cormorant, Stibium, Dintch, Fintch and cintch * Long Reads * Mac Troubleshooting Summary * LockRattler: 11.0 Big Sur * M1 & M2 Macs * Mints: a multifunction utility * LockRattler: 12.x Monterey * VisualLookUpTest * Virtualisation on Apple silicon * LockRattler: 13.x Ventura Secondary navigation * Search Post navigation Glowing with the Paintings of Theo van Rysselberghe 2: 1908 to 1926 Solutions to Saturday Mac riddles 194 Search for: [ ] [Search] Begin typing your search above and press return to search. Press Esc to cancel. * Follow Following + [croppe] The Eclectic Light Company Join 3,171 other followers [ ] Sign me up + Already have a WordPress.com account? Log in now. * + [croppe] The Eclectic Light Company + Customize + Follow Following + Sign up + Log in + Copy shortlink + Report this content + View post in Reader + Manage subscriptions + Collapse this bar Loading Comments... Write a Comment... [ ] Email (Required) [ ] Name (Required) [ ] Website [ ] [Post Comment] %d bloggers like this: [b]