Search code examples
macosfilesystemsmetadatasandboxappstore-sandbox

OS X sandboxing: difference between xattr and metadata

In order to do sandbox testing for an app I'm writing for OS X, I'm using sandbox-exec. I'm wondering what's the difference between the rules (deny file-read-xattr) and (deny file-read-metadata)?

Solution
    • file-metadata is stored on a Filesystem-Level directly in the filenode: eg. last-modified-date
    • xattr are filesystem agnostic and extendable: eg. com.apple.FinderInfo, com.apple.TextEncoding, com.apple.metadata:kMDItemWhereFroms

    Depending on which level you operate with files within your application (NSFileManager and NSURL or plain-old-c) you will probably need both read rules.