xattr [-lrsvx] file …
xattr -p [-lrsvx] name file …
xattr -w [-rsx] name value file …
xattr -d [-rsv] name file …
xattr -c [-rsv] file …
Display, modify or remove the extended attributes of files, directories or symbolic links.
Extended attributes are arbitrary metadata stored separately from the basic filesystem attributes
(such as modification time or file size).
Operations: | ||||||||||||||||||||||
| without an operation, displays name only> xattr trackpad.c com.apple.TextEncoding | |||||||||||||||||||||
-p [-lrsvx] name file … print the | value for name displayed as strings, unless nulls are in the data or with -x then they are displayed in hexadecimal.
> ls -l track*
-rw-r--r-- 1 uusser staff 126 Jun 12 2011 trackPad.mak
-rw-r--r--@ 1 uusser staff 1490 Sep 16 2011 trackpad.c
⇑ indicates xattr exists
> xattr -p com.apple.TextEncoding trackpad.c
utf-8;134217984 134217984 = x'8000100'
> xattr -p -l com.apple.TextEncoding trackpad.c
com.apple.TextEncoding: utf-8;134217984
> xattr -p -lx com.apple.TextEncoding trackpad.c
com.apple.TextEncoding:
00000000 75 74 66 2D 38 3B 31 33 34 32 31 37 39 38 34 |utf-8;134217984|
0000000f
-w [-rsx] name value file … write | name and value .value a string or with -x hexadecimal (whitespace ignored) The xxd utility can be used to create hexadecimal representations from binary data.
-d [-rsv] name file … delete | name ( and value )
-c [-rsv] file … clear all extended attributes
| Options:
| -l |
value
is often a null-terminated UTF-8 string, but can be arbitrary binary data.
No such file: file
with a return status of 1 is reported for symbolic links if -s
is not supplied!
[Errno 32] Broken pipe might be reported if xattr
is piped to head
ENOATTR |
Some attribute data may have a fixed length that is enforced by the system. For example,
The% xattr -w com.apple.FinderInfo 0 foo xattr: [Errno 34] Result too large: 'foo'
com.apple.FinderInfo
attribute must be 32 bytes in length.
Warning:
"file.jar" can't be opened because it is from an unidentified developer.
Your securty preferences allow installation of only apps from the App Store and identified developers.
browser downloaded this file xxx at hh:mm from
domain
ls -l@ CSVFixer.jar -rw-r--r--@ 1 dgerman staff 3663 Jan 15 16:06 CSVFixer.jar com.apple.lastuseddate#PS 16 com.apple.metadata:kMDItemDownloadedDate 53 com.apple.metadata:kMDItemWhereFroms 97 com.apple.quarantine 57
com.apple.FinderInfo
attribute to the MyDir
from the /usr
directory
>xattr -px com.apple.FinderInfo /usr 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > xattr -l MyDir > xattr -wx com.apple.FinderInfo \ "`xattr -px com.apple.FinderInfo /usr`" MyDir > xattr -l MyDir com.apple.FinderInfo: 000 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......| 010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 020list then Clear xattributes
> xattr -l * Makefile: com.apple.quarantine: 0000;4fd141a7;Firefox.app;|org.mozilla.firefox cmds.c: com.apple.quarantine: 0000;4fd141f3;Firefox.app;|org.mozilla.firefox > xattr -c *additional bytes totaling 17,793,106!
/Volumes/biggies/.MobileBackups/Computer/2016-02-15-013729/Volume > xattr -l realger1_birding-2.sql.gz com.apple.backupdelta.deletionMarkerAndFile: yes com.apple.backupdelta.inodeForDeletionOriginal: 1657554 com.apple.metadata:kMDItemDownloadedDate: 000 62 70 6C 69 73 74 30 30 A1 01 33 41 BA A1 09 3E |bplist00..3A...>| 010 A2 AE 19 08 0A 00 00 00 00 00 00 01 01 00 00 00 |................| 020 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 |................| 030 00 00 00 00 13 |.....| 035 com.apple.metadata:kMDItemWhereFroms: 000 62 70 6C 69 73 74 30 30 A2 01 02 5F 10 53 68 74 |bplist00..._.Sht| 010 74 70 73 3A 2F 2F 72 65 61 6C 2D 77 6F 72 6C 64 |tps://real-world| 020 2D 73 79 73 74 65 6D 73 2E 63 6F 6D 3A 32 30 38 |-systems.com:208| 030 33 2F 63 70 73 65 73 73 33 34 37 35 37 30 39 35 |3/cpsess34757095| 040 37 34 2F 33 72 64 70 61 72 74 79 2F 70 68 70 4D |74/3rdparty/phpM| 050 79 41 64 6D 69 6E 2F 65 78 70 6F 72 74 2E 70 68 |yAdmin/export.ph| 060 70 5F 10 8C 68 74 74 70 73 3A 2F 2F 72 65 61 6C |p_..https://real| 070 2D 77 6F 72 6C 64 2D 73 79 73 74 65 6D 73 2E 63 |-world-systems.c| 080 6F 6D 3A 32 30 38 33 2F 63 70 73 65 73 73 33 34 |om:2083/cpsess34| 090 37 35 37 30 39 35 37 34 2F 33 72 64 70 61 72 74 |75709574/3rdpart| 0A0 79 2F 70 68 70 4D 79 41 64 6D 69 6E 2F 69 6E 64 |y/phpMyAdmin/ind| 0B0 65 78 2E 70 68 70 3F 74 6F 6B 65 6E 3D 64 32 34 |ex.php?token=d24| 0C0 36 61 62 61 64 37 31 64 61 35 65 32 33 61 39 36 |6abad71da5e23a96| 0D0 30 65 62 33 32 35 66 65 61 61 64 36 64 26 64 62 |0eb325feaad6d&db| 0E0 3D 72 65 61 6C 67 65 72 31 5F 6D 6F 6F 64 6C 65 |=realger1_moodle| 0F0 08 0B 61 00 00 00 00 00 00 01 01 00 00 00 00 00 |..a.............| 100 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 110 00 00 F0 |...| 113 com.apple.quarantine: 0042;54f0d1be;Safari.app;87B13B67-43A5-4AF1-80E1-C48D90FFB53D xattr -l DaveDennisPepperMaggieAbbieJune2014.jpg: com.apple.quarantine: 0042;54f903a0;Preview; xattr -l eicar # anti-virus test file uk.co.canimaansoftware.clamxav.infection-state: infected uk.co.markallan.clamxav.infection-state: infected xattr -l track* trackpad.c: com.apple.TextEncoding: utf-8;134217984 .. (parent directory) com.apple.progress.fractionCompleted 11 Desktop/DGGinfo.gif: com.apple.metadata:kMDItemScreenCaptureType: 000 62 70 6C 69 73 74 30 30 57 64 69 73 70 6C 61 79 |bplist00Wdisplay| 010 08 00 00 00 00 00 00 01 01 00 00 00 00 00 00 00 |................| 020 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 030 10 |.| 031 eatz.txt: com.apple.TextEncoding: macintosh;0 folderTree0: com.apple.quarantine: 0001;51deed09;Thunderbird.app; roombaBrushes.jpg: com.apple.quarantine: 0042;50f843a8;Preview; Documents/1984.txt.html: com.apple.metadata:kMDItemWhereFroms: 000 62 70 6C 69 73 74 30 30 A1 01 5F 10 2C 68 74 74 |bplist00.._.,htt| 010 70 3A 2F 2F 67 75 74 65 6E 62 65 72 67 2E 6E 65 |p://gutenberg.ne| 020 74 2E 61 75 2F 65 62 6F 6F 6B 73 30 31 2F 30 31 |t.au/ebooks01/01| 030 30 30 30 32 31 2E 74 78 74 08 0A 00 00 00 00 00 |00021.txt.......| 040 00 01 01 00 00 00 00 00 00 00 02 00 00 00 00 00 |................| 050 00 00 00 00 00 00 00 00 00 00 39 |..........9| 05b Documents/1984.txt.html: com.apple.quarantine: 0000;55859397;Safari.app; Documents/3D+printerComparion.html: com.apple.metadata:kMDItemDownloadedDate: 000 62 70 6C 69 73 74 30 30 A1 01 33 41 B9 6C A5 84 |bplist00..3A.l..| 010 12 C9 C1 08 0A 00 00 00 00 00 00 01 01 00 00 00 |................| 020 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 |................| 030 00 00 00 00 13 |.....| 035 com.apple.metadata:kMDItemWhereFroms: 000 62 70 6C 69 73 74 30 30 A1 01 5F 10 34 68 74 74 |bplist00.._.4htt| 010 70 3A 2F 2F 77 77 77 2E 6D 61 6B 65 72 73 68 65 |p://www.makershe| 020 64 2E 63 6F 6D 2F 70 61 67 65 73 2F 33 64 2D 70 |d.com/pages/3d-p| 030 72 69 6E 74 65 72 2D 63 6F 6D 70 61 72 69 73 6F |rinter-compariso| 040 6E 08 0A 00 00 00 00 00 00 01 01 00 00 00 00 00 |n...............| 050 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 060 00 00 41 |..A| com.apple.quarantine: 0000;53bc6e03;Safari.app; 063 xattr -l "Documents alias" com.apple.FinderInfo: 000 66 64 72 70 4D 41 43 53 84 00 00 00 00 00 00 00 |fdrpMACS........| 010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 020 com.apple.ResourceFork: 000 00 00 01 00 00 37 B0 C8 00 37 AF C8 00 00 00 52 |.....7...7.....R| … 190 00 00 00 00 00 00 00 00 00 00 00 00 00 07 64 67 |..............dg| 1A0 65 72 6D 61 6E 00 00 10 00 08 00 00 C8 F7 9B 85 |erman...........| 1B0 00 00 00 11 00 08 00 00 C8 DB FA 78 00 00 00 01 |...........x....| 1C0 00 04 00 03 13 B3 00 02 00 17 44 41 54 41 3A 64 |..........DATA:d| 1D0 67 65 72 6D 61 6E 3A 00 44 6F 63 75 6D 65 6E 74 |german:.Document| 1E0 73 00 00 0E 00 14 00 09 00 44 00 6F 00 63 00 75 |s........D.o.c.u| 1F0 00 6D 00 65 00 6E 00 74 00 73 00 0F 00 0A 00 04 |.m.e.n.t.s......| 200 00 44 00 41 00 54 00 41 00 12 00 12 2F 64 67 65 |.D.A.T.A..../dge| 210 72 6D 61 6E 2F 44 6F 63 75 6D 65 6E 74 73 00 13 |rman/Documents..| 220 00 0D 2F 56 6F 6C 75 6D 65 73 2F 44 41 54 41 00 |../Volumes/DATA.| 230 00 15 00 02 00 15 FF FF 00 00 00 1B D7 43 69 63 |.............Cic| 240 6E 73 00 1B D7 43 54 4F 43 20 00 00 00 70 69 73 |ns...CTOC ...pis| 250 33 32 00 00 02 37 73 38 6D 6B 00 00 01 08 69 63 |32...7s8mk....ic|
0037B0E0 00 1C 00 52 00 01 61 6C 69 73 00 00 00 12 69 63 |...R..alis....ic| 0037B0F0 6E 73 00 01 00 1E 00 00 FF FF 00 00 00 00 00 00 |ns..............| 0037B100 00 00 BF 90 FF FF 00 00 01 3A 00 00 00 00 BF B9 |.........:......| 0037B110 FF FF 00 1B D8 81 03 00 00 00 |..........|As of OS X El Captian 10.11
xattr -l /usr com.apple.FinderInfo: 000 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......| 010 00-00 020 com.apple.rootless: /usr > sudo xattr -d com.apple.rootless /usr Password: xattr: [Errno 1] Operation not permitted: '/usr'Some examples:
com.apple.quarantine a quarantine status, the time when a file was quarantined, and the application that downloaded a file.
| com.apple.metadata:kMDItemWhereFroms | 100-566 the URL where a file was downloaded from, sometimes also including the chain of URLs that were redirected to that URL.
| com.apple.metadata:kMDItemDownloadedDate | 53 time when a file was downloaded.
| com.apple.metadata:kMDItemFinderComment | Spotlight comment, which is usually also stored in a .DS_Store file.
| com.apple.metadata:_kMDItemUserTags | tags.
| com.apple.metadata:kMDItemDownloadedDate 53 |
| com.apple.metadata:kMDItemWhereFroms78,119 |
| com.apple.metadata:kMDLabel_jmugefj4ksjcrhaoknys6lqqay 89
| com.apple.metadata:com_apple_backup_excludeItem | 61
| com.apple.decmpfs | implement HFS+ compression. It is not shown by xattr.
| com.apple.diskimages.fsck | 20 verification status for DMG files.
| com.apple.FinderInfo | 32 file flags, which are not actually stored as an extended attribute.
| com.apple.lastuseddate#PS 16
| com.apple.progress.fractionCompleted | 1,4 for a .download bundle.
| com.apple.ResourceFork | 286 which is not actually stored as an extended attribute.
| com.apple.system.Security | implement ACLs. It is not shown by xattr.
| com.apple.TextEncoding 11,15 | for a file saved with an application like TextEdit.
| com.apple.ubd.prsid | ? Library/Mobile Documents.95670203:
| com.apple.Preview.UIstate.v1 244,252,255,258,262
| com.apple.diskimages.recentcksum 79 ,80,81
| com.apple.quarantine 22,25,26,30,31,34,38,42,46,49,54,57,60,61,70,74,78,85,89
NSImageMetadata
| com.apple.diskimages.fsck: | 000 CD B4 BF D6 65 3E 83 91 82 4E 6B D3 00 1E 6B 60 |....e>...Nk...k`| 010 B4 26 CE 16 |.&..| 014 |