Navigate / search

Managing files with extended attributes on Mac OS X

I’ve recently learned something on the Mac OS X — Extended Attributes. It’s those files where you’d see the at-sign (@) at the end of file permissions when you do an ‘ls -l‘ command on a Mac OS X terminal. I encountered them when I was trying to modify the firmware on my Android based Samsung Spica mobile phone. When I started manipulating the firmware files I’ve downloaded, I noticed that I would have extra files while creating a tar file.

I’ve narrowed down my problem to files on the Mac OS X with Extended Attributes. You’ll know that these files have extended attributes by using the ls command in a Mac OS X terminal shell. One situation you’ll find them is when you download files from the Internet. Mac OS X normally adds the com.apple.quarantine extended attribute to files. You can check them out by doing an ‘ls -l‘ command. You’ll get a list of files similar to the one below:

total 3816
-rw-------@ 1 kihbord  staff  566009 Apr 18 06:32 file1.tar.gz
-rw-------@ 1 kihbord  staff  842827 Apr 18 06:33 file1.tar
-rw-------@ 1 kihbord  staff  538342 Apr 18 10:08 readme.txt

To manage extended attributes on Mac OS X, you need to use the ‘xattr’ program. You can use it to list, add, delete extended attributes in Mac OS X files. Note: Be careful when using the xattr command. It can screw things up on your system since those extended attributes where placed there for a reason in the first place.

To get a list of extended attributes of a file named file1.tar, just type in the ‘xattr file1.tar‘ command and press return. You see something like:

$ xattr file1.tar
com.apple.quarantine

To remove an extended attribute of file1.tar, just type ‘xattr -d com.apple.quarantine file1.tar‘. When you do an ‘ls -l‘, you’ll notice that the at-sign is gone if that was the only extended attribute of the file.

total 3816
-rw-------@ 1 kihbord  staff  566009 Apr 18 06:32 file1.tar.gz
-rw-------  1 kihbord  staff  842827 Apr 18 06:33 file1.tar
-rw-------@ 1 kihbord  staff  538342 Apr 18 10:08 readme.txt

It’s important to note that extended attributes are used by the Mac OS X operating system to flag certain files. For instance, the com.apple.quarantine extended attribute is added by Mac OS X (Leopard in my case, haven’t tried it in Snow Leopard if it’s the same) whenever you download files from the Internet. If you try to open the file using the Mac OS X Finder, it will warn you that the file was downloaded and prompt you if you want to continue. If you answer ‘yes’, Mac OS X will remove the com.apple.quarantine extended attribute and open the file.

In my case, I removed the extended attribute so that Mac OS X won’t create extra files when I start creating tar files that I would be using on my Android based Samsung Spica mobile phone. As a warning, be aware that removing such attributes can pose security risks for your Mac so use them with care and at your own risk.

Gerry Ilagan

Gerry Ilagan is into mobile apps and WordPress development at @speeqs. He loves to write about electronics, the Internet of Things, mobile phones, and #crazyideas.

Comments

Noah Stephen
Reply

Helpful article. Tif and PSD files are causing Photoshop, Preview, and Firefox to crash. I’ve tried typing in xattr IMG_2399.tif and it doesn’t find the file. Any idea why not?

Leave a comment

name*

email* (not published)

website