xattr

Display and manipulate extended attributes

 
     xattr    [-lrsvx] file …

     xattr -p [-lrsvx] name file …

     xattr -w [-rsx] name value file …

     xattr -d [-rsv] name file …

     xattr -c [-rsv] file …

Display, modify or remove the extended attributes of files, directories or symbolic links.
These are indicated by ls with an @, for example:

ls -l
total 34028
-rw-r--r--   1 duser  staff       688 Mar 19 12:08 0
-rw-r--r--@  1 duser  staff      4134 Mar 19 08:57 CHANGELOG.md
-rw-r--r--@  1 duser  staff     13724 Mar 19 08:57 Makefile
drwxr-xr-x@ 32 duser  staff      1024 Mar 19 08:57 src/

> ls -l@ LICENSE #  and name displayed 
-rw-r--r--@ 1 duser  staff  1505 Mar 19 08:57 LICENSE
    com.apple.quarantine      21 length 
> xattr -pl
com.apple.quarantine: 0082;6054cb0e;Safari;

Extended attributes are arbitrary metadata stored separately from the basic filesystem attributes (such as modification time or file size).

	without an operation, displays `name` only > xattr trackpad.c com.apple.TextEncoding
`-l`	long format, both `names` and `values` are displayed. Default: only names or values. Use `-x` for hexadecimal display, output is preceeded with the hexadecimal offset, values and followed by ASCII display, enclosed by `\|` xattr -lx ruuvitag_b.ld.orig com.apple.lastuseddate#PS: 00000000 3D 6A 45 60 00 00 00 00 53 20 D4 38 00 00 00 00 \|=jE`....S .8....\| 00000010 com.apple.quarantine: 0083;605cdc3b;Safari;68E96022-E6D0-450E-9EF3-0E7E699AF83F
`-p [-lrsvx] name file …`	print the `value` for `name` Displayed as strings, unless nulls are in the data or with `-x` then they are displayed in hexadecimal. > ls -l track* -rw-r--r-- 1 uusser staff 126 Jun 12 2011 trackPad.mak -rw-r--r--@ 1 uusser staff 1490 Sep 16 2011 trackpad.c ⇑ indicates xattr exists > xattr -p com.apple.TextEncoding trackpad.c utf-8;134217984 134217984 = x'8000100' > xattr -p -l com.apple.TextEncoding trackpad.c com.apple.TextEncoding: utf-8;134217984 > xattr -p -lx com.apple.TextEncoding trackpad.c com.apple.TextEncoding: 00000000 75 74 66 2D 38 3B 31 33 34 32 31 37 39 38 34 \|utf-8;134217984\| 0000000f
`-w [-rsx] name value file …`	write `name` and `value`. `value` a string or with `-x` hexadecimal (whitespace ignored) The `xxd` utility can be used to create hexadecimal representations from binary data.
`-d [-rsv] name file …`	delete `name` ( and `value`)
`-c [-rsv] file …`	clear all extended attributes
Options:
`-r`	recursively process directories
`-s`	symbolic link itself is acted on, if `file` is a symbolic link,
`-v`	verbosely display file name ( with only one file the name is otherwise supressed)
`-x`	display in hexadecimal
`‑‑help -h`

value is often a null-terminated UTF-8 string, but can be arbitrary binary data.

Exit status

On error, non-zero is returned, and an error message is output to standard error.

HOWEVER, no message is displayed and then return code is 0 if the file does not exist!

For system call errors, both the error code and error string are output

No such file: file with a return status of 1 is reported for symbolic links if -s is not supplied!

[Errno 32] Broken pipe might be reported if xattr is piped to head

`ENOATTR`	No extended attribute
`EEXIST`	named attribute exists with XATTR_CREATE
`ENOATTR`	no attribute with XATTR_REPLACE
`EACCES`	Access denied for search for a component of path or permission is denied to read attributes from .
`EROFS`	Read Only File System
`EINVAL`	invalid name or options has an unsupported bit set.
`EISDIR`	Is a Directory but the attribute in question is only applicable to files. Similar to `EPERM`.
`ELOOP`	Looping symbolic links
`EFAULT`	path points to an invalid address.
`ENOTSUP`	NOT Supported by the file system or xattr is disabled.
`ENOTDIR`	NOT a DIRectory
`ENAMETOOLONG`	name exceeds XATTR_MAXNAMELEN UTF-8 bytes, or a component of path exceeds NAME_MAX characters, or the entire path exceeds PATH_MAX characters.
`ERANGE`	namebuf (as indicated by size) is too small to hold the list of names.
`EPERM`	path or fd refer to a file system object that does not support extended attributes. For example, resource forks don't support extended attributes.
`EIO`	I/O error occurred.
`EINVAL`	INVAiLd options
`E2BIG`	size of the extended attribute is too large.
`ENOSPC`	Not enough SPaCe left on the file system.

Some attribute data may have a fixed length that is enforced by the system. For example,

> xattr -w com.apple.FinderInfo 0 foo
xattr: [Errno 34] Result too large: 'foo'

The com.apple.FinderInfo attribute must be 32 bytes in length.

Warning:

Some extended attribute values can be VERY large (like 3,649,818 bytes producing a hex&char display of several megabytes).
Displaying this to a terminal may not be a good idea.

EXAMPLES

Downloaded jar file:

"file.jar" can't be opened because it is from an unidentified developer.
Your securty preferences allow installation of only apps from the App Store and identified developers.
browser downloaded this file xxx at hh:mm from
domain

ls -l@ CSVFixer.jar 
-rw-r--r--@ 1 duser  staff  3663 Jan 15 16:06 CSVFixer.jar
    com.apple.lastuseddate#PS     16 
    com.apple.metadata:kMDItemDownloadedDate      53 
    com.apple.metadata:kMDItemWhereFroms      97 
    com.apple.quarantine      57

Copy the com.apple.FinderInfo attribute to the MyDir from the /usr directory

>xattr -px com.apple.FinderInfo /usr
00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> xattr -l MyDir
> xattr -wx com.apple.FinderInfo \
"`xattr -px com.apple.FinderInfo /usr`" MyDir
> xattr -l MyDir
com.apple.FinderInfo:
000  00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  |........@.......|
010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
020

list then Clear xattributes

> xattr -l *
Makefile: com.apple.quarantine: 0000;4fd141a7;Firefox.app;|org.mozilla.firefox
cmds.c: com.apple.quarantine: 0000;4fd141f3;Firefox.app;|org.mozilla.firefox

> xattr -c *

/Volumes/biggies/.MobileBackups/Computer/2016-02-15-013729/Volume > xattr -l realger1_birding-2.sql.gz
com.apple.backupdelta.deletionMarkerAndFile: yes
com.apple.backupdelta.inodeForDeletionOriginal: 1657554
com.apple.metadata:kMDItemDownloadedDate:
000  62 70 6C 69 73 74 30 30 A1 01 33 41 BA A1 09 3E  |bplist00..3A...>|
010  A2 AE 19 08 0A 00 00 00 00 00 00 01 01 00 00 00  |................|
020  00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  |................|
030  00 00 00 00 13                                   |.....|
035
com.apple.metadata:kMDItemWhereFroms:
000  62 70 6C 69 73 74 30 30 A2 01 02 5F 10 53 68 74  |bplist00..._.Sht|
010  74 70 73 3A 2F 2F 72 65 61 6C 2D 77 6F 72 6C 64  |tps://real-world|
020  2D 73 79 73 74 65 6D 73 2E 63 6F 6D 3A 32 30 38  |-systems.com:208|
030  33 2F 63 70 73 65 73 73 33 34 37 35 37 30 39 35  |3/cpsess34757095|
040  37 34 2F 33 72 64 70 61 72 74 79 2F 70 68 70 4D  |74/3rdparty/phpM|
050  79 41 64 6D 69 6E 2F 65 78 70 6F 72 74 2E 70 68  |yAdmin/export.ph|
060  70 5F 10 8C 68 74 74 70 73 3A 2F 2F 72 65 61 6C  |p_..https://real|
070  2D 77 6F 72 6C 64 2D 73 79 73 74 65 6D 73 2E 63  |-world-systems.c|
080  6F 6D 3A 32 30 38 33 2F 63 70 73 65 73 73 33 34  |om:2083/cpsess34|
090  37 35 37 30 39 35 37 34 2F 33 72 64 70 61 72 74  |75709574/3rdpart|
0A0  79 2F 70 68 70 4D 79 41 64 6D 69 6E 2F 69 6E 64  |y/phpMyAdmin/ind|
0B0  65 78 2E 70 68 70 3F 74 6F 6B 65 6E 3D 64 32 34  |ex.php?token=d24|
0C0  36 61 62 61 64 37 31 64 61 35 65 32 33 61 39 36  |6abad71da5e23a96|
0D0  30 65 62 33 32 35 66 65 61 61 64 36 64 26 64 62  |0eb325feaad6d&db|
0E0  3D 72 65 61 6C 67 65 72 31 5F 6D 6F 6F 64 6C 65  |=realger1_moodle|
0F0  08 0B 61 00 00 00 00 00 00 01 01 00 00 00 00 00  |..a.............|
100  00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
110  00 00 F0                                         |...|
113
com.apple.quarantine: 0042;54f0d1be;Safari.app;87B13B67-43A5-4AF1-80E1-C48D90FFB53D



xattr -l DaveDennisPepperMaggieAbbieJune2014.jpg: com.apple.quarantine: 0042;54f903a0;Preview;

xattr -l eicar      # anti-virus test file
uk.co.canimaansoftware.clamxav.infection-state: infected
uk.co.markallan.clamxav.infection-state: infected

xattr -l track*
trackpad.c: com.apple.TextEncoding: utf-8;134217984

..  (parent directory)
com.apple.progress.fractionCompleted       11 

Desktop/DGGinfo.gif: com.apple.metadata:kMDItemScreenCaptureType:
000  62 70 6C 69 73 74 30 30 57 64 69 73 70 6C 61 79  |bplist00Wdisplay|
010  08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 00  |................|
020  01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
030  10                                               |.|
031


eatz.txt:          com.apple.TextEncoding: macintosh;0
folderTree0:       com.apple.quarantine: 0001;51deed09;Thunderbird.app;
roombaBrushes.jpg: com.apple.quarantine: 0042;50f843a8;Preview;

Documents/1984.txt.html: com.apple.metadata:kMDItemWhereFroms:
000  62 70 6C 69 73 74 30 30 A1 01 5F 10 2C 68 74 74  |bplist00.._.,htt|
010  70 3A 2F 2F 67 75 74 65 6E 62 65 72 67 2E 6E 65  |p://gutenberg.ne|
020  74 2E 61 75 2F 65 62 6F 6F 6B 73 30 31 2F 30 31  |t.au/ebooks01/01|
030  30 30 30 32 31 2E 74 78 74 08 0A 00 00 00 00 00  |00021.txt.......|
040  00 01 01 00 00 00 00 00 00 00 02 00 00 00 00 00  |................|
050  00 00 00 00 00 00 00 00 00 00 39                 |..........9|
05b

Documents/1984.txt.html: com.apple.quarantine: 0000;55859397;Safari.app;

Documents/3D+printerComparion.html: 
com.apple.metadata:kMDItemDownloadedDate:
000  62 70 6C 69 73 74 30 30 A1 01 33 41 B9 6C A5 84  |bplist00..3A.l..|
010  12 C9 C1 08 0A 00 00 00 00 00 00 01 01 00 00 00  |................|
020  00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  |................|
030  00 00 00 00 13                                   |.....|
035
com.apple.metadata:kMDItemWhereFroms:
000  62 70 6C 69 73 74 30 30 A1 01 5F 10 34 68 74 74  |bplist00.._.4htt|
010  70 3A 2F 2F 77 77 77 2E 6D 61 6B 65 72 73 68 65  |p://www.makershe|
020  64 2E 63 6F 6D 2F 70 61 67 65 73 2F 33 64 2D 70  |d.com/pages/3d-p|
030  72 69 6E 74 65 72 2D 63 6F 6D 70 61 72 69 73 6F  |rinter-compariso|
040  6E 08 0A 00 00 00 00 00 00 01 01 00 00 00 00 00  |n...............|
050  00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
060  00 00 41                                         |..A|
com.apple.quarantine: 0000;53bc6e03;Safari.app;
063



xattr -l "Documents alias"
com.apple.FinderInfo:
000  66 64 72 70 4D 41 43 53 84 00 00 00 00 00 00 00  |fdrpMACS........|
010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
020
com.apple.ResourceFork:
000  00 00 01 00 00 37 B0 C8 00 37 AF C8 00 00 00 52  |.....7...7.....R| …

190  00 00 00 00 00 00 00 00 00 00 00 00 00 07 64 67  |..............dg|
1A0  65 72 6D 61 6E 00 00 10 00 08 00 00 C8 F7 9B 85  |erman...........|
1B0  00 00 00 11 00 08 00 00 C8 DB FA 78 00 00 00 01  |...........x....|
1C0  00 04 00 03 13 B3 00 02 00 17 44 41 54 41 3A 64  |..........DATA:d|
1D0  67 65 72 6D 61 6E 3A 00 44 6F 63 75 6D 65 6E 74  |german:.Document|
1E0  73 00 00 0E 00 14 00 09 00 44 00 6F 00 63 00 75  |s........D.o.c.u|
1F0  00 6D 00 65 00 6E 00 74 00 73 00 0F 00 0A 00 04  |.m.e.n.t.s......|
200  00 44 00 41 00 54 00 41 00 12 00 12 2F 64 67 65  |.D.A.T.A..../dge|
210  72 6D 61 6E 2F 44 6F 63 75 6D 65 6E 74 73 00 13  |rman/Documents..|
220  00 0D 2F 56 6F 6C 75 6D 65 73 2F 44 41 54 41 00  |../Volumes/DATA.|
230  00 15 00 02 00 15 FF FF 00 00 00 1B D7 43 69 63  |.............Cic|
240  6E 73 00 1B D7 43 54 4F 43 20 00 00 00 70 69 73  |ns...CTOC ...pis|
250  33 32 00 00 02 37 73 38 6D 6B 00 00 01 08 69 63  |32...7s8mk....ic|

additional bytes totaling 17,793,106!

0037B0E0  00 1C 00 52 00 01 61 6C 69 73 00 00 00 12 69 63  |...R..alis....ic|
0037B0F0  6E 73 00 01 00 1E 00 00 FF FF 00 00 00 00 00 00  |ns..............|
0037B100  00 00 BF 90 FF FF 00 00 01 3A 00 00 00 00 BF B9  |.........:......|
0037B110  FF FF 00 1B D8 81 03 00 00 00                    |..........|

As of OS X El Captian 10.11

xattr -l /usr
com.apple.FinderInfo:
000  00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  |........@.......|
010  00-00
020
com.apple.rootless: 
/usr > sudo xattr -d com.apple.rootless /usr
Password:
xattr: [Errno 1] Operation not permitted: '/usr'

Some examples:

`com.apple.lastuseddate#PS 16`	FFFFFFFFF5B 00 00 00 00 FFF67 52 1E 00 00 00 00 > xattr -l hex* \|hexdump -C 00000000 68 65 78 64 75 6d 70 63 63 63 3a 20 63 6f 6d 2e \|hexdumpccc: com.\| 00000010 61 70 70 6c 65 2e 6c 61 73 74 75 73 65 64 64 61 \|apple.lastusedda\| 00000020 74 65 23 50 53 3a 20 a5 ca 81 5b 0a \|te#PS: ...[.\| 0000002c `NSMetadataItemLastUsedDateKey` Does NOT seem to reflect the last Used Date
`com.apple.quarantine`	time when a file was quarantined, and application that downloaded a file.
`com.apple.quarantine 22,25,26,30,31,34,38,42,46,49,54,57,60,61,70,74,78,85,89 (( "%&0148BFITWptx…‰ )) apparently not text.`
`com.apple.quarantine: d002;5786571b;Safari.app;A7173968-A74A-4CF6-A618-781494E1E0FE`
`com.apple.metadata:kMDItemWhereFroms 100-566`	the URL where a file was downloaded from, sometimes also including the chain of URLs that were redirected to that URL.
`com.apple.metadata:kMDItemWhereFroms78,119`
`com.apple.metadata:kMDItemDownloadedDate 53`	time when a file was downloaded.
`com.apple.metadata:_kMDItemUserTags`	tags.
`com.apple.metadata:kMDItemFinderComment`	Spotlight comment, which is usually also stored in a .DS_Store file.
`com.apple.metadata:kMDLabel_jmugefj4ksjcrhaoknys6lqqay 89`
`com.apple.metadata:com_apple_backup_excludeItem 61`
`com.apple.decmpfs`	implement HFS+ compression. It is not shown by xattr.
`com.apple.diskimages.fsck`	20 verification status for DMG files.
`com.apple.FinderInfo`	32 file flags, which are not actually stored as an extended attribute.
`com.apple.progress.fractionCompleted`	1,4 for a .download bundle.
`com.apple.ResourceFork`	286 which is not actually stored as an extended attribute.
`com.apple.system.Security`	implement ACLs. It is not shown by xattr.
`com.apple.TextEncoding 11,15`	for a file saved with an application like TextEdit.
`com.apple.ubd.prsid`	? Library/Mobile Documents.95670203:
`com.apple.Preview.UIstate.v1 244,252,255,258,262`
`/etc/fing`	_kTimeMachineNewestSnapshot _kTimeMachineOldestSnapshot
Prevents finder from opening:
`com.apple.finder.copy.checkpoint#N:`
`com.apple.finder.copy.source.inode#N:`
`com.apple.finder.copy.source.volumeuuid#N: 209066D7-AAD7-46FB-AC09-7FDADA96A54C`
`com.apple.metadata:kMDItemResumableCopy: bplist00_XE9FBC316-5864-50F1-AF43-2DA86A8CA1E2/Volumes/DATA/dgerman/Documents/computerstuff/phyweb`

`com.apple.diskimages.recentcksum 7 ,80,81 NSImageMetadata`
`com.apple.diskimages.fsck:`	CD B4 BF D6 65 3E 83 91 82 4E 6B D3 00 1E 6B 60 B4 26 CE 16
`com.apple.diskimages.recentcksum: i:6200308 on B1CA7351-D631-3AA7-8D0F-B2BC3D7CA2E4 @ 1449099544 - CRC32:$7BA8C2E1`

bug

 xattr -lx i.sh
com.apple.metadata:kMDLabel_gqfsrsjabcr6qc7jv3ogtzaqpi:
00000000  FFF25 57 04 FFF45 4A FFF37 10 53 FFFFFFFFFFFF25  |.%W..EJ.7.S....%|
00000010  FFFFFF7B 5C 19 05 6F FFFFFFFFF3C 03 7E FFFFFF02  |..{\..o...<.~...|
00000020  FFFFFF36 23 5B FFFFFFFFF58 05 0B FFFFFFFFF49 71  |..6#[...X.....Iq|
00000030  3B FFFFFFFFF53 38 FFF1F FFFFFFFFFFFF47 FFFFFF42  |;...S8......G..B|
00000040  FFFFFFFFFFFF5D FFF00 55 FFFFFFFFF6F 65 FFF5F FFFFFFC5  |....]...........|
00000050  FFFFFF6A 3F FFF5D 69 FFFFFFFFFFFF34 6A FFF68 FFFFFFA0  |..j?.]i....4j.h.|
00000060  51 74 30 FFF47 FFFFFF59 FFF11 FFF03 FFF74 14 01  |Qt0.G..Y.....t..|
00000070  49 FFF76 FFFFFF12 FFFFFFFFFFFF64 FFFFFF48 FFF32  |I.v.......d..H.2|
00000080  05 FFF2E FFFFFF7F 34 FFFFFFFFFFFF72 6F FFFFFF38  |......4....ro..8|
00000090  FFF65 0D FFFFFF23 20 1F 6E FFF06 FFFFFF2F 36 FFFFFFE0  |.e...# .n..../6.|
000000A0  FFF60 43 5E 09 19 09 FFF75 FFFFFF18 5E FFF26 FFFFFFCF  |.`C^....u...^.&.|
000000B0  2D FFF75 79 56 0F FFFFFF6E 24 FFFFFF04 FFF62 78  |-.uyV...n$....bx|
000000C0  5C 64 02 67 FFF21 FFF39 3C FFFFFFFFFFFFFFF56 FFFFFFB5  |\d.g.!.9<.....V.|
000000D0  5A FFF3E 3F FFFFFF3B FFFFFF14 FFFFFF59 FFFFFFFFFFFFF6  |Z.>?..;.....Y...|
000000E0  15 2F 49 FFF35 FFFFFFFFFFFF35 6B 00 78 1F 79 4F  |./I.5....5k.....|
000000F0  FFF16 FFF03 48 28 10 47 FFFFFFD3                 |....H(.G.|
000000F9
> xattr -l i.sh
com.apple.metadata:kMDLabel_gqfsrsjabcr6qc7jv3ogtzaqpi: ?%W?EJ?7S?%?{\o???<~????6#[?X
                                                                                      ???Iq;?ТS8?????G??B??ې]?
> xattr -l i.sh|hexdump -C
00000000                                                    |com.apple.metada|
00000010                                                    |ta:kMDLabel_gqfs|
00000020                                                    |rsjabcr6qc7jv3og|
00000030                       20  f2 25 57 04 b2 45 4a ad  |tzaqpi: .%W..EJ.|
00000040  37 10 53 ce ee a5 a9 25  ed 88 7b 5c 19 05 6f c8  |7.S....%..{\..o.|
00000050  ce e8 3c 03 7e 98 8e 02  9a c3 36 23 5b f3 b7 96  |..<.~.....6#[...|
00000060  58 05 0b f8 84 de 49 71  3b e6 d0 a2 53 38 99 1f  |X.....Iq;...S8..|
00000070  8a 9d f9 83 47 fe e4 42  cf f0 db 90 5d 8d 0a     |....G..B....]..|
0000007f