**Quarantine, Translocation, and Preference Panes**
by James W. Walker
31 May 2024
# Quarantine
When a file is downloaded by a web browser or email client, an extended attribute of type
`com.apple.quarantine` is attached to it. You can view this attribute at the command
line as follows,
```
xattr -p com.apple.quarantine path-to-file
```
producing output similar to:
```
0083;665a3b74;Safari;39DF211A-EBF4-4ADD-A049-85801D70E2BC
```
The first 4 characters are hexadecimal characters encoding 16 undocumented bit flags.
If the downloaded file happens to be a zip archive or disk image, the quarantine attribute
is inherited by the contents. That is, if you decompress a zip, those items are assigned
the same quarantine attribute.
If you move a file from the original location where unzipping put it, or if you copy a
file out of a disk image, then the `0100` bit gets set in the quarantine attribute.
For example, if the quarantine attribute originally started with `0083`, now it starts
with `0183`. So it appears that the `0100` bit means that the item was moved or copied
from its original location.
The first time you open a quarantined app, the OS does some security check, such as
checking for notarization, and even if all seems well, asks you to affirm that you want
to open the app.
Assuming you do go ahead and open the app, the OS sets the `0040` bit in the quarantine
attribute. For instance if the attribute originally started with `0083`, now it starts
with `00C3`. This flag lets the OS skip the first-run tests the next time you open the
app.
# App Translocation
Having discussed two of the bits in the quarantine attribute, let's see how they interact.
If both are set (flags like `01C3`), meaning that the app has been opened and moved or
copied, then it runs normally. Something more interesting happens when an app has been
opened but not moved or copied. (That is, you're running the app directly where it was
unzipped, or right on the disk image.) In that case, the app is subject to "app
translocation", also known as "path randomization". This means that the OS executes the
app as if it was at some other random location. Ideally it shouldn't matter, but some
apps may be confused by this.
# Preference Panes
A preference pane is a bundle of extension `.prefPane` that implements a third-party
addition to the System Preferences or System Settings window. Unlike an app, a
preference pane that is moved or copied does not get its "moved" flag set in the
quarantine attribute. Consequently, if the preference pane bundle contains a helper app,
that app will always run in a translocated state.