Quarantined login item does not run.

Code Signing General
Kentzo
Kentzo OP
Created Jan ’23
Replies 8
Boosts 0
Views 2.6k
Participants 2

I have an app that seems to be properly signed and notarized which I installed using Homebrew. Upon the first launch macOS warned that the app was downloaded from the internet and asked whether I want to proceed, to which I agreed. Subsequent launches do not show this warning.

However, launchd refuses to launch its login item:

2023-01-11 10:23:16.258575 (gui/501/org.p0deje.Maccy-LaunchAtLoginHelper [16190]) <Warning>: Could not find and/or execute program specified by service: 155: Refusing to execute/trust quarantined program/file: org.p0deje.Maccy-LaunchAtLoginHelper

Indeed, the com.apple.quarantine is still set on the app itself and all is contents, including this helper:

$ ls -la@ /Applications/Maccy.app                   
total 0
drwxr-xr-x@  3 kentzo  staff    96 Aug 31 14:20 .
	com.apple.macl	  72 
	com.apple.provenance	  11 
	com.apple.quarantine	  67 
drwxrwxr-x  84 root    admin  2688 Jan 11 10:20 ..
drwxr-xr-x@ 11 kentzo  staff   352 Aug 31 14:29 Contents
	com.apple.quarantine	  67

codesign and scptl seem to be happy though:

$ codesign --verify -vvv /Applications/Maccy.app
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftObjectiveC.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftObjectiveC.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreImage.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreImage.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftXPC.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftXPC.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftCore.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftCore.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftAppKit.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftAppKit.dylib
--prepared:/Applications/Maccy.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app
--validated:/Applications/Maccy.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app
--prepared:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.Downloader.xpc
--validated:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.Downloader.xpc
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreGraphics.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreGraphics.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftMetal.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftMetal.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreData.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreData.dylib
--prepared:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.InstallerConnection.xpc
--validated:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.InstallerConnection.xpc
--prepared:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.InstallerStatus.xpc
--validated:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.InstallerStatus.xpc
--prepared:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.InstallerLauncher.xpc
--validated:/Applications/Maccy.app/Contents/XPCServices/org.sparkle-project.InstallerLauncher.xpc
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftos.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftos.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftDispatch.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftDispatch.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftDarwin.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftDarwin.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreFoundation.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreFoundation.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftQuartzCore.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftQuartzCore.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/Sparkle.framework/Versions/Current/.
--validated:/Applications/Maccy.app/Contents/Frameworks/Sparkle.framework/Versions/Current/.
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftIntents.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftIntents.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftIOKit.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftIOKit.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreLocation.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftCoreLocation.dylib
--prepared:/Applications/Maccy.app/Contents/Frameworks/libswiftFoundation.dylib
--validated:/Applications/Maccy.app/Contents/Frameworks/libswiftFoundation.dylib
/Applications/Maccy.app: valid on disk
/Applications/Maccy.app: satisfies its Designated Requirement
 
$ codesign --display -vvv /Applications/Maccy.app 
Executable=/Applications/Maccy.app/Contents/MacOS/Maccy
Identifier=org.p0deje.Maccy
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=6460 flags=0x10000(runtime) hashes=191+7 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=fab018cde6fe6239b18e2a5a9055b9b6c0ca7ee2
CandidateCDHashFull sha256=fab018cde6fe6239b18e2a5a9055b9b6c0ca7ee2f1d34d9cb8e114a1f72b28b5
Hash choices=sha256
CMSDigest=fab018cde6fe6239b18e2a5a9055b9b6c0ca7ee2f1d34d9cb8e114a1f72b28b5
CMSDigestType=2
Launch Constraints:
	None
CDHash=fab018cde6fe6239b18e2a5a9055b9b6c0ca7ee2
Signature size=8981
Authority=Developer ID Application: Alexey Rodionov (MN3X4648SC)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Aug 31, 2022 at 2:21:06 PM
Info.plist entries=29
TeamIdentifier=MN3X4648SC
Runtime Version=12.3.0
Sealed Resources version=2 rules=13 files=186
Internal requirements count=1 size=208
 
$ spctl -a -t exec -vvv /Applications/Maccy.app 
/Applications/Maccy.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Alexey Rodionov (MN3X4648SC)

Other apps with login items that I downloaded with Safari and manually moved to /Applications seem to work properly. What could be wrong with Homebrew's installation process?

Tested on 13.1 with M1 processor, homebrew 3.6.15

Replies  8
Boosts  0
Views  2.6k
Participants  2
Apple Staff, DTS Engineer
DTS Engineer OP
Apple
Jan ’23

How are you installing this login item? With SMAppService? Or the older SMLoginItemSetEnabled?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0
Kentzo
Kentzo OP
Jan ’23

It uses the older SMLoginItemSetEnabled.

0
Apple Staff, DTS Engineer
DTS Engineer OP
Apple
Jan ’23

I’m not sure what’s going on here. I can speak to this though:

Indeed, the com.apple.quarantine is still set on the app itself and all is contents, including this helper

That’s normal, at least on modern systems. For example, yesterday I downloaded Hex Fiend using Safari, unpacked it, and dragged it to the Applications directory, and it still has the quarantine attribute:

% ls -ld@ "/Applications/Hex Fiend.app/"
drwxr-xr-x@ 3 quinn  admin  96 13 Jun  2022 /Applications/Hex Fiend.app/
    com.apple.macl  72 
    com.apple.provenance    11 
    com.apple.quarantine    57

ISTR that, at some point in the past, running on app would remove its quarantine attributes entirely, but that’s certainly not the case on modern systems (I’m testing on macOS 13.0.1 btw).

Looking into this further, I downloaded Hex Fiend again and dumped its state before and after running it. Here’s the before state:

% ls -l@ "Hex Fiend.app/Contents/MacOS/Hex Fiend" 
-rwxr-xr-x@ 1 quinn  staff  1148560 13 Jun  2022 Hex Fiend.app/Contents/MacOS/Hex Fiend
    com.apple.quarantine         57 
% xattr -p com.apple.quarantine "Hex Fiend.app/Contents/MacOS/Hex Fiend"
0183;63c124b2;Safari;9E4CFAF2-C88B-4D3A-BA79-AB36F2CBA029
% QQuarantine show "Hex Fiend.app/Contents/MacOS/Hex Fiend"
Hex Fiend.app/Contents/MacOS/Hex Fiend:
  LSQuarantineAgentBundleIdentifier: com.apple.Safari
  LSQuarantineAgentName: Safari
  LSQuarantineEventIdentifier: 9E4CFAF2-C88B-4D3A-BA79-AB36F2CBA029
  LSQuarantineIsOwnedByCurrentUser: 1
  LSQuarantineTimeStamp: 2023-01-13 09:30:26 +0000
  LSQuarantineType: LSQuarantineTypeWebDownload

Note QQuarantine is a tool I wrote to dump the quarantine state of an item, as returned by the .quarantinePropertiesKey URL resource.

Here’s the after state:

% ls -l@ "Hex Fiend.app/Contents/MacOS/Hex Fiend"                     
-rwxr-xr-x@ 1 quinn  staff  1148560 13 Jun  2022 Hex Fiend.app/Contents/MacOS/Hex Fiend
    com.apple.quarantine         57 
% xattr -p com.apple.quarantine "Hex Fiend.app/Contents/MacOS/Hex Fiend"
01c3;63c124b2;Safari;9E4CFAF2-C88B-4D3A-BA79-AB36F2CBA029
% QQuarantine show "Hex Fiend.app/Contents/MacOS/Hex Fiend"
Hex Fiend.app/Contents/MacOS/Hex Fiend:
  -

So the quarantine has definitely gone away but that hasn’t removed the quarantine attribute. However, you can see that there’s a single flag changed in that attribute.

I think you should repeat your Homebrew install and then look at the value of the attribute on the main executable of the login item.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

1
Kentzo
Kentzo OP
Jan ’23

Okay, I seem to get to the bottom of this.

One detail that I missed is that I run homebrew installation process as a non-admin user and group:

$ dscl . -read /Users/brew
dsAttrTypeNative:IsHidden: 1
PrimaryGroupID: 801
RealName: Homebrew
RecordName: brew
RecordType: dsRecTypeStandard:Users
UniqueID: 801
UserShell: /usr/bin/false
 
$ dscl . -read /Groups/brew
GroupMembership: brew
PrimaryGroupID: 801
RealName: Homebrew
RecordName: brew
RecordType: dsRecTypeStandard:Groups

When Homebrew installs the app, I end up with a bundle owned by brew:brew. Launching the app with login user will display the warning only once, but the quarantine attribute will remain with unchanged value regardless of how many times I restart it. However, if I chown the app to the login user before the launch, I will get the warning again (even if I already got one when it was owned by other user) but this time attribute's value will get cleared.

Do you think I should file a bug?

0
Apple Staff, DTS Engineer
DTS Engineer OP
Apple
Jan ’23

Nice spelunking!

but the quarantine attribute will remain with unchanged value regardless of how many times I restart it.

Interesting. I suspect that’s because the Applications folder is only writable by admin:

% ls -ld /Applications 
drwxrwxr-x  111 root  admin  3552 15 Jan 09:43 /Applications

Do you think I should file a bug?

Sure. But against Homebrew or macOS, that’s the question? (-:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0
Kentzo
Kentzo OP
Jan ’23

Hmm, why would writability of /Application have any effect though?

The installation process run via Homebrew by a non-admin user[1], in a nutshell, uses a shell script that downloads app's archive, unpacks it and then uses sudo[2] to move it to /Applications. As a result, I end up with a brew:brew owned app in the /Applications directory with the quarantine attribute assigned and set.

When I run the app via my main admin user account and agree to the dialog (which is shown exactly once, on the first run only) I expect the quarantine attribute to get cleared for my main admin user. The login item is added to the gui/ domain so I expect launchd to consult the appropriate database when checking whether the login item is allowed to run.

The way I understand gatekeeper process (root daemons) and quarantine attribute (values are per-user[3]), neither writability of /Applications nor /Applications/Maccy.app should have any effect.

[1]:

$ sudo -u brew id
uid=801(brew) gid=801(brew) groups=801(brew),101(access_bpf),12(everyone),20(staff),61(localaccounts),701(com.apple.sharepoint.group.1),100(_lpoperator)

[2]: On my machine, sudoers is set up such that plain sudo uses my main admin user account and not root via the runas_default and runaspw settings.

[3]: If you run the app and agree to the warning then quit it and chown it someone else, it will display the warning again on the next run. So I'm not sure whether the actual quarantine value is preserved per file owner, per process owner or a combination of both.

0
Kentzo
Kentzo OP
Jan ’23

Interesting. I suspect that’s because the Applications folder is only writable by admin

But the user that's launching the app is an admin (me).

Anyway, why does writability of /Applications or even /Applications/.app affects the behavior? Isn't the actual value of the quarantine attribute stored in a db somewhere else, per-user?

0
Kentzo
Kentzo OP
Feb ’23

FWIW I have file the bug via Feedback Assistant: FB11958573

0
Quarantined login item does not run.
First post date Last post date
 
 
Q