Enabling File Quarantine for apps

Question

Created Feb ’23

Replies 3

Boosts 0

Views 1.4k

Participants 2

Is there any additional work that developers need to do to enable File Quarantine for their apps besides adding LSFileQuarantineEnabled to their Info.plist (and all the helpers)?

All files made by the app's processes should be quarantined by macOS without any additional changes to the app by the developer correct?

Thanks!

Answered by DTS Engineer in 746131022

Should they be using any special file write API to additionally support File Quarantine?

Nope. Consider this snippet:

let s = """
    #! /bin/sh
    echo 'Hello Cruel World!'
    """
let u = FileManager
    .default
    .homeDirectoryForCurrentUser
    .appendingPathComponent("test.command")
    .absoluteURL
try! s.write(to: u, atomically: true, encoding: .utf8)
_ = chmod(u.path, 0o755)

If LSFileQuarantineEnabled is not present, the resulting ~/test.command file opens and runs in Terminal. If it is, Terminal stops with a Gatekeeper alert.

Having said that, there are advantages in applying quarantine directly (using the .quarantinePropertiesKey property) in that it gives you more control.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Feb ’23

Presumably you’re talking about macOS here.

Is your app sandboxed or not?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

brandon-dalton OP

Feb ’23

Hey Quinn! That’s correct and the app does not opt into Apple’s sandbox model. Should they be using any special file write API to additionally support File Quarantine?

0

Answer 3

DTS Engineer OP

Apple

Feb ’23

Accepted Answer

Should they be using any special file write API to additionally support File Quarantine?

Nope. Consider this snippet:

let s = """
    #! /bin/sh
    echo 'Hello Cruel World!'
    """
let u = FileManager
    .default
    .homeDirectoryForCurrentUser
    .appendingPathComponent("test.command")
    .absoluteURL
try! s.write(to: u, atomically: true, encoding: .utf8)
_ = chmod(u.path, 0o755)

If LSFileQuarantineEnabled is not present, the resulting ~/test.command file opens and runs in Terminal. If it is, Terminal stops with a Gatekeeper alert.

Having said that, there are advantages in applying quarantine directly (using the .quarantinePropertiesKey property) in that it gives you more control.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0