Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS gatekeeper and file quarantine bypass

objective-see.com

Post reply on HN
Print view View original

41–50 of 125 posts

Re: macOS gatekeeper and file quarantine bypass

#41

Post by Isthatablackgsd »

mschuster91 wrote: post #32
Isthatablackgsd wrote: post #5

Earlier quoted context omitted.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

Macports doesn't give you any headaches, it follows Unix principles. Homebrew is a keg of worms, if you excuse the bad pun. Sadly (because it seems to be easier to get started?) many developers prefer it over Macports...

As an end-user, I prefer Homebrew over MacPorts because Homebrew is simpler to get it installed and use in the terminal. MacPorts in other hand, takes some tinkering to get it working. It has problem detecting installed XCode because it was looking for a specific outdated version (this happened last month when I decided to give MacPorts a try and I uninstalled Homebrew before trying it out since both of them cannot co-exist together.)

It is likely that it is not the devs prefers it over MacPorts, it is likely that end-users prefers it and the devs are following what the end-users desires. Homebrew have huge catalog of software and libraries than MacPorts.

Re: macOS gatekeeper and file quarantine bypass

#42

Post by xrisk »

oivey wrote: post #40
xrisk wrote: post #39

Earlier quoted context omitted.

He’s talking about Homebrew Cask.

Even more specifically, the only time I’ve ran into Gatekeeper is with apps that install into /Applications and have a GUI. I’ve never had this issue with stuff I only access via CLI.

You have to Ctrl+right click the app, then click Open.

Re: macOS gatekeeper and file quarantine bypass

#43

Post by jdlshore »

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks.

The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

Re: macOS gatekeeper and file quarantine bypass

#44

Post by fryktelig »

xrisk wrote: post #39
kstrauser wrote: post #15

Earlier quoted context omitted.

I use Homebrew daily. In System Preferences, I have Security & Privacy > General > Allow apps downloaded from: App Store and identified developers, and I don't remember the last time I got a Gatekeeper alert.

He’s talking about Homebrew Cask.

I've been having issues with non-cask Homebrew packages getting blocked by some Gatekeeper/SIP related watchdog on my new M1 system. Stuff would just get insta-killed at load. Anyway, it seems to have been sorted now, and through identifying which packages were having the issue in Console and reinstalling them, I've resolved the issues.

Re: macOS gatekeeper and file quarantine bypass

#45

Post by spijdar »

boomboomsubban wrote: post #31
bobbylarrybobby wrote: post #28

Earlier quoted context omitted.

I was under the impression that unless a file contains some other metadata (most don't), that the extension is the way the OS chooses which app to use to open it.

Unix-based has almost always used internal metadata, and the "dot" is just another character. I thought Windows was unique in relying on the suffixes, but Wikipedia suggests MacOS inherited some form from NextSTEP.

"Unix" OSes in my experience simply don't (universally) have a way to "open this file in the correct application". It's a foreign concept. Files are just sequences of bytes, and file paths are just addresses to those bytes. The file extensions are, then, purely for the sake of the user, as there is no (standard) way to store file metadata. There are specific filesystems with these metadata extensions, but otherwise, you need to resort to commands like file and libmagic for heuristics on determining file-type.

Or just use the file suffix, which is AFAIK what all the mainstream Linux desktop environments do, through Freedesktop's MIME implementation. I don't know if it supports using metadata or file magics instead, but a quick glance shows almost every MIME definition uses file globbing.

You can check this in the files located at "/usr/share/mime/application" and "/usr/share/mime/packages" on most distros. Most (all?) definitions use a "glob pattern" to match files.

Re: macOS gatekeeper and file quarantine bypass

#46

Post by Wowfunhappy »

cloogshicer wrote: post #37
smoldesu wrote: post #2

Gatekeeper is one of the most frustrating things I have to fight whenever I try using MacOS. It feels like DRM for my applications, which in turn makes everything feel clunkier, and less integrated. I would genuinely pay Apple extra for a version of MacOS that just trusts me and lets me install what I want without the some esoteric mechanism stopping me at every step of the way...

Agreed. It's ridiculous that we can't even fully disable it in the latest macOS releases (the commands others posted below don't work in Big Sur to completely disable quarantine). Thankfully there is a simple workaround: https://hiringengineersbook.com/post/disable-quarantine/

Note, the single command does turn off Gatekeeper. File quarantine is separate and needs a separate command. That is as it should be IMO, they’re completely different things.

Re: macOS gatekeeper and file quarantine bypass

#47

Post by joshspankit »

Wowfunhappy wrote: post #9
smoldesu wrote: post #2

Gatekeeper is one of the most frustrating things I have to fight whenever I try using MacOS. It feels like DRM for my applications, which in turn makes everything feel clunkier, and less integrated. I would genuinely pay Apple extra for a version of MacOS that just trusts me and lets me install what I want without the some esoteric mechanism stopping me at every step of the way...

Then turn it off. Open the Terminal and run: sudo spctl --master-disable That's it, it will never bother you again, unless you turn it back on or reinstall the OS from scratch. If macOS is still too limiting, you can also turn off System Integrity Protection, at which point you can do just about whatever the heck you want. I personally kept both Gatekeeper and SIP turned off, back when I used modern macOS. But if the…

Does turning those off still leave the logs redacted?

Or do you also have to install the profile after you tell it to get out of your way?

Re: macOS gatekeeper and file quarantine bypass

#48

Post by Isthatablackgsd »

kstrauser wrote: post #36
Isthatablackgsd wrote: post #22

Earlier quoted context omitted.

I have that option enabled since the first booting of my Macbook Air M1 and gatekeeper alert is still showing. And I am sure we are not using the same apps that ran into those alerts. I have Vivaldi, Alfred, AppCleaner, EasyFind, iTerm2, KeepassXC, MacPass, Keka, MediaInfo, NoMachine, Numi, OBS, odrive, Signal, Slack, TexStudio and VLC ran into those alert. I am genuinely curious why people are singing that "I don't…

You're hugely misreading my intentions. I'm an engineer: I see something unexpected, I want to figure out what's happening. You and I are both using the same software and you're seeing problems that I didn't even know affected some people. I'm not saying "this works for me so I don't know what you're complaining about". I'm saying "huh, this works for me. I wonder what's different between our systems? Is this somethi…

Apologies for misreading you, I'm just frustrated and accepted the fact that it is by design.

I been reading other comments and as someone (xrisk) pointed out that it is Homebrew Casks which it made sense since all of the gatekeeper alerts is coming from 'Cask-ed' apps. I could disable Gatekeeper but I rather not because MacOS is not my daily driver. I rather to keep Gatekeeper active to protect itself from moronic me.

Re: macOS gatekeeper and file quarantine bypass

#49

Post by Wowfunhappy »

joshspankit wrote: post #47
Wowfunhappy wrote: post #9

Earlier quoted context omitted.

Then turn it off. Open the Terminal and run: sudo spctl --master-disable That's it, it will never bother you again, unless you turn it back on or reinstall the OS from scratch. If macOS is still too limiting, you can also turn off System Integrity Protection, at which point you can do just about whatever the heck you want. I personally kept both Gatekeeper and SIP turned off, back when I used modern macOS. But if the…

Does turning those off still leave the logs redacted? Or do you also have to install the profile after you tell it to get out of your way?

I don’t use Big Sur but I don’t think it has any affect on logs. Without SIP, you could patch the kernel or something and change whatever you want, but that would of course be nuts.

I share your curiosity. If your computer isn't already managed, installing an MDM profile in order to view logs is ridiculous. I don’t even think there’s a way to do it without paying money.

Re: macOS gatekeeper and file quarantine bypass

#50

Post by submeta »

jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

What about macOS Catalina users? Any updates / fixes for them? Do you happen to know?
Post reply on HN