OS X 10.8: reset approved, unsigned application memory

Question

With OS X 10.8 Apple introduced a feature to make it harder to install unsigned applications. Usually, it works to right-click the unsigned application, choose Open and confirm the occurring dialog. The next time, this application can be launched like any signed one.

How can I reset OS X' knowledge of the confirmed application, so it will reject to launch it the next time?

Answer 1

Gate Keeper uses the quarantine functionality that has been present for a while to annoy users after they download files.

You can examine a file's quarantine information by reading its com.apple.quarantine extended attribute. Here I do this for a never before launched .app copied from a downloaded .dmg:

$ xattr -l Butler.app/
com.apple.quarantine: 0002;50697c0e;Safari;942183F8-A268-447B-AEAB-55CEA27DD911

The first value is the quarantine state (i.e. the interesting part). It's followed by a hex-encoded Unix timestamp (in this case: date -r 0x50697c0e results in Mo 1 Okt 2012 13:18:38 CEST), the name of the application creating the file, and a unique identifier (UUID) of the original quarantined item. This last one is inherited by extracted files from their container, in this case, the .dmg file.

---

The first part of the extended attribute is the quarantine state. When downloaded and never opened, this file has 0002, possibly indicating a web download.

When you double-click the app, but abort when asked for confirmation, it's 0022 (probably to record earlier execution without approval), and when you confirm execution once, it's 0062. In that case, you won't be asked again afterwards. This looks a lot like an octal or hexadecimal representation of a bit field, with the third 4 value bit indicating approval, and the third 2 value bit indicating prior execution.

By resetting this value to the original state after download, you can re-enable the Gate Keeper protection. Just read the value after opening (xattr -p com.apple.quarantine <filename>) and replace it with the same value, without the "this was already approved" bits (e.g. xattr -w com.apple.quarantine 0002;[rest of the previous value] <filename>).