Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With OS X 10.8 Apple introduced a feature to make it harder to install unsigned applications. Usually, it works to right-click the unsigned application, choose Open and confirm the occurring dialog. The next time, this application can be launched like any signed one.

How can I reset OS X' knowledge of the confirmed application, so it will reject to launch it the next time?

share|improve this question
up vote 4 down vote accepted

Gate Keeper uses the quarantine functionality that has been present for a while to annoy users after they download files.

You can examine a file's quarantine information by reading its extended attribute. Here I do this for a never before launched .app copied from a downloaded .dmg:

$ xattr -l 0002;50697c0e;Safari;942183F8-A268-447B-AEAB-55CEA27DD911

The first value is the quarantine state (i.e. the interesting part). It's followed by a hex-encoded Unix timestamp (in this case: date -r 0x50697c0e results in Mo 1 Okt 2012 13:18:38 CEST), the name of the application creating the file, and a unique identifier (UUID) of the original quarantined item. This last one is inherited by extracted files from their container, in this case, the .dmg file.

The first part of the extended attribute is the quarantine state. When downloaded and never opened, this file has 0002, possibly indicating a web download.

When you double-click the app, but abort when asked for confirmation, it's 0022 (probably to record earlier execution without approval), and when you confirm execution once, it's 0062. In that case, you won't be asked again afterwards. This looks a lot like an octal or hexadecimal representation of a bit field, with the third 4 value bit indicating approval, and the third 2 value bit indicating prior execution.

By resetting this value to the original state after download, you can re-enable the Gate Keeper protection. Just read the value after opening (xattr -p <filename>) and replace it with the same value, without the "this was already approved" bits (e.g. xattr -w 0002;[rest of the previous value] <filename>).

share|improve this answer
Thanks for the details. Is this correct: if I build an (unsigned) application myself, it will not contain any quarantine information and hence not show up the nag dialog? – Mike L. Oct 1 '12 at 16:10
@MikeL. The quarantine information is added by the downloading program when creating the file. Download via wget and circumvent the issue. While I didn't test it, I doubt Xcode sets quarantine information. – Daniel Beck Oct 1 '12 at 22:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.