How to remove quarantine flags for files downloaded by sandboxed app

Question

Created Jun ’21

Replies 2

Boosts 0

Views 4.1k

Participants 2

Hello, I have a sandboxed app distributed through macOS AppStore. It downloads some 'dylib' files from a server(internet) and later loads using dlopen(). But the downloaded files have quarantine flag set and thus Gatekeeper shows a warning when the app loads them.

Added LSFileQuarantineEnabled in info.plist and set to false but it didn't help.
Tried to run a shell command "xattr -d filename" from the app itself but that doesn't work too due to "operation not permitted" error.
Tried [file1 setResourceValue:nil forKey:NSURLQuarantinePropertiesKey error:nil] but even this doesn't make any difference. Although the return value of the call is "YES", the quarantine flag is still there. Note : when i run this method from a non-sandboxed app, it works.

Now I don't have any more options. Is there any way a sandboxed app can download a file and remove the quarantine attribute?

Answered by DTS Engineer in 680151022

It downloads some .dylib files from a server (internet) and later loads using dlopen.

…

Can anyone tell me if I can just go ahead and use the flag and submit to app store ?

First up, the decision about what is or isn’t allowed on the store is made by App Review. I don’t work for App Review and can’t make definitive statements on their behalf.

Having said that:

com.apple.security.files.user-selected.executable is intended for apps that are generating code locally, like an IDE. It was not created to facilitate running code that was downloaded from the ’net.
App Review has published policy about this in their App Store Review Guidelines (search for “download”).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

santoshh OP

Jun ’21

Ok. Found a way. Adding com.apple.security.files.user-selected.executable in entitlements solves the issue. It worked even without adding LSFileQuarantineEnabled in info.plist file.

https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html#//apple_ref/doc/uid/TP40011195-CH4-SW6

According to above link, Apple mentions that we can use the flag to not set the quarantine flags. However, according to someone in https://developer.apple.com/forums/thread/115610, the app got rejected from App Store for using the flag.

Can anyone tell me if I can just go ahead and use the flag and submit to app store ?

0

Answer 2

DTS Engineer OP

Apple

Jun ’21

Accepted Answer

It downloads some .dylib files from a server (internet) and later loads using dlopen.

…

Can anyone tell me if I can just go ahead and use the flag and submit to app store ?

First up, the decision about what is or isn’t allowed on the store is made by App Review. I don’t work for App Review and can’t make definitive statements on their behalf.

Having said that:

com.apple.security.files.user-selected.executable is intended for apps that are generating code locally, like an IDE. It was not created to facilitate running code that was downloaded from the ’net.
App Review has published policy about this in their App Store Review Guidelines (search for “download”).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0