{"id":800,"date":"2020-01-07T06:21:09","date_gmt":"2020-01-07T11:21:09","guid":{"rendered":"https:\/\/www.brunerd.com\/blog\/?p=800"},"modified":"2021-02-28T09:33:16","modified_gmt":"2021-02-28T14:33:16","slug":"track-and-tackle-com-apple-macl","status":"publish","type":"post","link":"https:\/\/www.brunerd.com\/blog\/2020\/01\/07\/track-and-tackle-com-apple-macl\/","title":{"rendered":"Track and Tackle com.apple.macl"},"content":{"rendered":"\n

UPDATE:<\/strong> As of Big Sur (macOS 11) the com.apple.macl<\/strong> extended attribute can be removed using: xattr -rd com.apple.macl <file\/folder><\/code><\/p>\n\n\n\n

\n\n\n\n

Starting in macOS Catalina, an extended attribute (XA) named com.apple.macl<\/strong> is being added to the files and folder you work with. What does it do? How does it work? When does it get added? Where is the documentation?<\/p>\n\n\n\n

All these are good questions, but there’s no official documentation. A good start is this assemblage<\/a> of articles, here’s the highlights from that page and a few more…<\/p>\n\n\n\n

Apple talked about this vaguely in their WWDC 2019 session 701, “Advances in macOS Security<\/a>“, the Files and Folders fun starts at 21:21 but there’s nothing really about the implementation<\/p>\n\n\n\n

Tom Bridge talked about<\/a> com.apple.macl to the Penn State Macadmins back in August before Catalina’s release. He’s one of the first to notice this XA (and talk about it). Although, he says that curl<\/code> will add this XA to downloads, it thankfully does not<\/em>. Most likely it happened when he dragged it to Terminal or performed some other action on it.<\/p>\n\n\n\n

Howard Oakley of the prolific Eclectic Light Company blog kicks the tires<\/a> a bit more and finds some interesting quirks, as he always does.<\/p>\n\n\n\n

Jeff Johnson though, really hits the nail on the head<\/a> in illustrating what’s going on when you simply drag and drop a file or folder into Terminal and com.apple.macl is appended. He dropped this, December 18th and well… the holidays were around the corner and we all had better stuff to do!<\/p>\n\n\n\n

It’s 2020 now and time to come back around to this. A very helpful post<\/a> in the Apple Dev forums from an Apple employee, Quinn “the Eskimo”, decodes the data structure a bit more as well as what some of the conditions for having this XA appended are:<\/p>\n\n\n\n

When a user selects a \u201cprotected\u201d file or folder in an NSOpenPanel in a non-sandboxed app on Catalina, consent is inferred and the app can access it.
…
It seems that 01 00 is a header of some form and … is a UUID associated with my test app.  I dug into how that UUID is set up and, well, it\u2019s complex, and more of an implementation detail than I care to go into here on DevForums.<\/strong><\/p>https:\/\/forums.developer.apple.com\/thread\/124121<\/cite><\/blockquote>\n\n\n\n

Well, I would have loved the complex implementation detail! But I’ll tell you this: The app UUID in com.apple.macl is unique to EVERY computer<\/span>. Jeff Johnson was right when he said: “The macl is effectively untraceable<\/a>“.<\/p>\n\n\n\n

However you can begin to see the shape of things when you write a tool to output the UUID in CSV like I have. Behold maclTrack.command<\/a><\/p>\n\n\n\n