Remove com.apple.quarantine: no such xattr: com.apple.quarantine?

When you run the ls -l@ command in Terminal to see the extended attributes attached to your files, you may notice that some files have the com.apple.quarantine attribute. If you're wondering what it is or how to get rid of it, this article is all you need.

What is com.apple.quarantine?

com.apple.quarantine is an extended attribute attached to files and apps you download from the internet, receive as email attachments, or obtain from other sources outside of the App Store. It's a quarantine attribute assigned by the application or service used to download or receive the file, like Google Chrome, Safari, or Mail.

When you attempt to open a quarantined application or file for the first time, you will be prompted to confirm your intent to open the file and macOS will run security checks to verify the file's safety. Here are the processes involved:

Warning Prompt: When you open a file or app that has the com.apple.quarantine attribute, macOS will present a prompt reminding you of the file's origin and asking if you want to open it.

Gatekeeper check: If you confirm, Gatekeeper will verify the app's developer signature to ensure it comes from an identified developer or the Mac App Store and check the integrity of the app to ensure its code hasn't been altered.

XProtect scan: If the app passes Gatekeeper, XProtect will scan it for known malicious content using its malware definitions. 

How to check the com.apple.quarantine attribute?

com.apple.quarantine is not a file and doesn't have a physical location on the disk where you can open and view it. But you can check whether a file has the com.apple.quarantine extended attribute or which file has the attribute by running the following commands in Terminal.

To check if a file or app has the com.apple.quarantine extended attribute: (If it has, it will return the attribute's value.)

xattr -p com.apple.quarantine file_path

To check which file(s) in a directory or app has the com.apple.quarantine extended attribute:

cd folder/app_name

find . -xattrname com.apple.quarantine

How to remove com.apple.quarantine?

Although the com.apple.quarantine attribute serves as a great security mechanism, it may prevent you from opening apps from an unidentified developer with errors like those listed below:

To manually remove the com.apple.quarantine attribute of a file or app, you just need to run the command below in Terminal.

xattr -d com.apple.quarantine file_path

For example, xattr -d com.apple.quarantine /applications/rstudio.app

To remove the com.apple.quarantine attribute recursively, execute this command instead:

xattr -r -d com.apple.quarantine folder_path

For example, xattr -r -d com.apple.quarantine /applications/steam.app  

If the command doesn't work or fail with the error "xattr: [Errno 13] Permission denied:", you can add sudo before them to run the commands with administrative privileges, such as: sudo xattr -d com.apple.quarantine /applications/visual studio code.app. Note that you need to enter the admin password and press Enter in this case. (The password won't echo to the screen.)

Spread the information to help others get rid of the com.apple.quarantine attribute.

No such xattr: com.apple.quarantine?

When you run the xattr -d com.apple.quarantine command or xattr -p com.apple.quarantine command to remove or view the com.apple.quarantine attribute of a file, Terminal will return you the message saying that there's No such xattr: com.apple.quarantine when the file doesn't currently have the attribute.

Some examples are:

How to get com.apple.quarantine back?

If you ever want the com.apple.quarantine attribute back after removing it, you can use the command below to restore it.

xattr -w com.apple.quarantine "Vaule" /path/to/your/file_or_app

If you didn't note down the attribute's value, you can enter the one in the example below.

To restore the com.apple.quarantine attribute to the app called iBoysoft Data Recovery, run: xattr -w com.apple.quarantine "0081;5f186d1d;Chrome;" /Applications/iBoysoft\ Data\ Recovery.app

Please share this post if you find it helpful!