Written byJenny Zeng
Remove com.apple.quarantine: no such xattr: com.apple.quarantine?
When you run the ls -l@ command in Terminal to see the extended attributes attached to your files, you may notice that some files have the com.apple.quarantine attribute. If you're wondering what it is or how to get rid of it, this article is all you need.
Table of Contents:
- 1. What is com.apple.quarantine?
- 2. How to check the com.apple.quarantine attribute?
- 3. How to remove com.apple.quarantine?
- 4. No such xattr: com.apple.quarantine?
- 5. How to get com.apple.quarantine back?
What is com.apple.quarantine?
com.apple.quarantine is an extended attribute attached to files and apps you download from the internet, receive as email attachments, or obtain from other sources outside of the App Store. It's a quarantine attribute assigned by the application or service used to download or receive the file, like Google Chrome, Safari, or Mail.
When you attempt to open a quarantined application or file for the first time, you will be prompted to confirm your intent to open the file and macOS will run security checks to verify the file's safety.
Warning Prompt: When you open a file or app that has the com.apple.quarantine attribute, macOS will present a prompt reminding you of the file's origin and asking if you want to open it.
Gatekeeper check: If you confirm, Gatekeeper will verify the app's developer signature to ensure it comes from an identified developer or the Mac App Store and check the integrity of the app to ensure its code hasn't been altered.
XProtect scan: If the app passes Gatekeeper, XProtect will scan it for known malicious content using its malware definitions.
How to check the com.apple.quarantine attribute?
com.apple.quarantine is not a file and doesn't have a physical location on the disk where you can open and view it. But you can check whether a file has the com.apple.quarantine extended attribute or which file has the attribute by running the following commands in Terminal.
To check if a file or app has the com.apple.quarantine extended attribute: (If it has, it will return the attribute's value.)
xattr -p com.apple.quarantine file_path
To check which file(s) in a directory or app has the com.apple.quarantine extended attribute:
find . -xattrname com.apple.quarantine
Note: The best way to get the path of a file or folder is to directly drag and drop it to Terminal.
How to remove com.apple.quarantine?
Although the com.apple.quarantine attribute serves as a great security mechanism, it may prevent you from opening apps from an unidentified developer with errors like those listed below:
To manually remove the com.apple.quarantine attribute of a file or app, you just need to run the command below in Terminal.
xattr -d com.apple.quarantine file_path
For example, xattr -d com.apple.quarantine /applications/rstudio.app
To remove the com.apple.quarantine attribute recursively, execute this command instead:
xattr -r -d com.apple.quarantine folder_path
For example, xattr -r -d com.apple.quarantine /applications/steam.app
If the command doesn't work or fail with the error "xattr: [Errno 13] Permission denied:", you can add sudo before them to run the commands with administrative privileges, such as: sudo xattr -d com.apple.quarantine /applications/visual studio code.app. Note that you need to enter the admin password and press Enter in this case. (The password won't echo to the screen.)
Tips: For more usage of the xattr command tool, run man xattr in Terminal.
Spread the information to help others get rid of the com.apple.quarantine attribute.
No such xattr: com.apple.quarantine?
When you run the xattr -d com.apple.quarantine command or xattr -p com.apple.quarantine command to remove or view the com.apple.quarantine attribute of a file, Terminal will return you the message saying that there's No such xattr: com.apple.quarantine when the file doesn't currently have the attribute.
Some examples are:
- xattr: /Applications/LICE.app: No such xattr: com.apple.quarantine
- xattr /opt/homebrew/bin/chromedriver: No such xattr com.apple.quarantine
- xattr /applications/visual studio code.app: No such xattr com.apple.quarantine
- xattr: chromedriver: No such xattr: com.apple.quarantine
How to get com.apple.quarantine back?
If you ever want the com.apple.quarantine attribute back after removing it, you can use the command below to restore it.
xattr -w com.apple.quarantine "Vaule" /path/to/your/file_or_app
If you didn't note down the attribute's value, you can enter the one in the example below.
To restore the com.apple.quarantine attribute to the app called iBoysoft Data Recovery, run: xattr -w com.apple.quarantine "0081;5f186d1d;Chrome;" /Applications/iBoysoft\ Data\ Recovery.app
Please share this post if you find it helpful!