Detect com.apple.quarantine bit

Content Authoring
1

We've run into a situation where the com.apple.quarantine bit needs to be removed from some files in our environment, with xattr -d com.apple.quarantine "/path/to/file".

I'd like to detect the problem files with relevance, but I'm not sure how. The security descriptors property is only available on Windows, and I haven't been able to get anywhere with inspecting the bytes of the file.

For example, my file has the quarantine bit:

Downloads % ls -al@ "myFile"
-rw-r--r--@ 1 user  staff  238 Sep 15 11:11 myFile
	com.apple.metadata:kMDItemWhereFroms	257 
	com.apple.quarantine	 58

I look at the bytes:

Q: concatenations of lasts 2 of ("0" & it) of (bytes (integers in (0,500)) of file "/path/to/myFile" as hexadecimal)
A: 4964656e7469747920547970652c557365726e616d652c446f6d61696e2c456d61696c2c4669727374204e616d652c4c617374204e616d652c557365722047726f7570732c436f756e74727920436f64650d0a4665646572617465642049442c6162633132332c6e79752e6564752c616263313233406e79752e6564752c4a6f686e2c536d6974682c4e5955204465706172746d656e7420412c55530d0a4665646572617465642049442c6465663435362c6e79752e6564752c646566343536406e79752e6564752c4a616e652c446f652c4e5955204465706172746d656e7420412c55530d0a2c2c2c2c2c2c2c
T: 13774
I: string

I remove the bit:

Downloads % xattr -d com.apple.quarantine "myFile"
Downloads % ls -al@ "myFile"
-rw-r--r--@ 1 user  staff  238 Sep 15 11:04 myFile
	com.apple.metadata:kMDItemWhereFroms	257

And the bytes stay the same:

Q: concatenations of lasts 2 of ("0" & it) of (bytes (integers in (0,500)) of file "/path/to/myFile" as hexadecimal)
A: 4964656e7469747920547970652c557365726e616d652c446f6d61696e2c456d61696c2c4669727374204e616d652c4c617374204e616d652c557365722047726f7570732c436f756e74727920436f64650d0a4665646572617465642049442c6162633132332c6e79752e6564752c616263313233406e79752e6564752c4a6f686e2c536d6974682c4e5955204465706172746d656e7420412c55530d0a4665646572617465642049442c6465663435362c6e79752e6564752c646566343536406e79752e6564752c4a616e652c446f652c4e5955204465706172746d656e7420412c55530d0a2c2c2c2c2c2c2c
T: 18728
I: string

Is there anything else I can try, purely with Relevance? I know I can deploy another action to check the file and trigger a follow up action to remediate.

2

https://bigfix.ideas.hcl-software.com/ideas/BFLCM-I-382

1 Like
3

Being that the bit is actually filesystem metadata, I'd wager there's nothing in the file to detect.

The only other thing I'd try offhand is sha values:

Q: (properties of type "file") whose (singular name of it starts with "sha")
A: sha1 of <file>: string
A: sha2_224 of <file>: string
A: sha2_256 of <file>: string
A: sha2_384 of <file>: string
A: sha2_512 of <file>: string
A: sha224 of <file>: string
A: sha256 of <file>: string
A: sha384 of <file>: string
A: sha512 of <file>: string
T: 267
I: property
4

I'm not overly familiar with Mac OS but a bit of digging, it appears some elements of the data is contained in /Users/{username}/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2. The file is a SqLIte database that contains, amongst other things, a file UID and it’s the file UID that pertain to the long string you see in the xattr output as well as a timestamp and agent that downloaded the quarantined file. As the database in SQLite it could be inspected via relevance but I can't see anything that would know what the file path is that belongs to the UID.

To inspect the database for each user, something like

rows of statement "select * from LSQuarantineEvent" of sqlite databases of files "com.apple.LaunchServices.QuarantineEventsV2" of folders "Library/Preferences" of folders of folder "/Users"

Probably not of much help but may trigger ideas from others in the community

3 Likes
5

Ooooo, insightful!

{forum padding}