Root cause of "Are you sure you want to open it?" warnings

[ace2600]

I recently got a new mac — running Snow Leopard — and am getting the “XXXX is an application downloaded from the internet. Are you sure you want to open it?” *every* time I open certain applications. On my old mbp, I only received the warning the first time running the application.

On my last setup, I had two user accounts that were both admin. This time, I'm trying to have a dedicated admin user and two non-admin users, which I do my work as. I *think* the issue arises when I put the apps in the /Applications/ directory when using the Admin user.

My questions are: what is causing this issue and how can I resolve it so the warning only pops up the first time. I expect it's a permission issue and I can hopefully just run chmod or chown on something.

To be clear, I'm not after disabling the warning, like in https://forums.macrumors.com/threads/788802/, I only want it to appear the first time.

 

[GGJstudios]

What application are you running that gives that warning each time?

 

[ace2600]

I did an ls -al of the /Applications directory. Interestingly enough, the applications with an '@' at the end of the permissions column are the ones that keep warning me.

Results:

drwxrwxr-x+ 44 root         admin   1.5K Apr 27 09:49 ./
drwxrwxr-t  31 root         admin   1.1K Apr 27 01:13 ../
-rw-r--r--@  1 Admin        admin   6.0K Apr 25 18:47 .DS_Store
-rw-r--r--   1 root         wheel     0B Jul  1  2009 .localized
drwxr-xr-x   3 root         wheel   102B Feb 11 18:23 Address Book.app/
drwxr-xr-x@  3 Admin        admin   102B Dec  1 20:04 Adium.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:33 Automator.app/
drwxr-xr-x   3 root         wheel   102B Jul  6  2009 Calculator.app/
drwxr-xr-x   3 root         wheel   102B May 19  2009 Chess.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 17:50 DVD Player.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Dashboard.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:35 Dictionary.app/
drwxr-xr-x@  3 Admin        admin   102B Apr  1 10:29 Firefox.app/
drwxr-xr-x   3 root         wheel   102B Aug 18  2009 Font Book.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Front Row.app/
drwxrwxr-x   3 root         admin   102B Mar  6 21:08 GarageBand.app/
drwxr-xr-x@  3 root         wheel   102B Apr  2 17:01 Google Chrome.app/
drwxrwxr-x   3 root         admin   102B Apr 25 23:23 Google SketchUp 7/
drwxr-xr-x   3 root         wheel   102B Feb 11 17:24 Image Capture.app/
drwxrwxr-x@ 20 Admin        admin   680B Apr 10 11:02 MAMP/
drwxr-xr-x   3 baalexander  admin   102B Mar  5 08:48 MacVim.app/
drwxr-xr-x   3 baalexander  admin   102B Mar 29 12:06 MagicPrefs.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:41 Mail.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:40 Photo Booth.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:29 Preview.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 QuickTime Player.app/
drwxr-xr-x   3 baalexander  admin   102B Apr 24 19:14 Rivet.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Safari.app/
drwxr-xr-x@  3 Admin        admin   102B Feb  8 08:15 Skype.app/
drwxr-xr-x   3 root         wheel   102B May 19  2009 Stickies.app/
drwxrwxr-x   3 root         wheel   102B Oct  1  2009 System Preferences.app/
drwxr-xr-x   3 root         wheel   102B Jun 29  2009 TextEdit.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Time Machine.app/
drwxr-xr-x@  3 Admin        admin   102B Mar 22 13:52 Unison.app/
drwxrwxr-x+ 28 root         admin   952B Mar  6 20:54 Utilities/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:40 iCal.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 iChat.app/
drwxrwxr-x   3 root         admin   102B Mar  6 21:08 iDVD.app/
drwxrwxr-x   3 root         admin   102B Apr 24 11:07 iMovie.app/
drwxrwxr-x   3 root         admin   102B Apr 24 11:07 iPhoto.app/
drwxr-xr-x   3 root         wheel   102B Sep 24  2009 iSync.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 iTunes.app/
drwxrwxr-x   3 root         admin   102B Mar  6 21:05 iWeb.app/

 

[ace2600]

From http://lists.apple.com/archives/macos-x-server/2008/Jan/msg00146.html, I ran this: ls -ale@ and got the following:

drwxrwxr-x+ 45 root         admin   1.5K Apr 27 10:10 ./
 0: group:everyone deny delete
drwxrwxr-t  31 root         admin   1.1K Apr 27 01:13 ../
-rw-r--r--@  1 Admin        admin   6.0K Apr 25 18:47 .DS_Store
        com.apple.FinderInfo      32B 
-rw-r--r--   1 root         wheel     0B Jul  1  2009 .localized
drwxr-xr-x   3 root         wheel   102B Feb 11 18:23 Address Book.app/
drwxr-xr-x@  3 Admin        admin   102B Dec  1 20:04 Adium.app/
        com.apple.quarantine      78B 
drwxr-xr-x   3 root         wheel   102B Feb 11 18:33 Automator.app/
drwxr-xr-x   3 root         wheel   102B Jul  6  2009 Calculator.app/
drwxr-xr-x   3 root         wheel   102B May 19  2009 Chess.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 17:50 DVD Player.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Dashboard.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:35 Dictionary.app/
drwxr-xr-x@  3 Admin        admin   102B Apr  1 10:29 Firefox.app/
        com.apple.FinderInfo      32B 
        com.apple.quarantine      78B 
drwxr-xr-x   3 root         wheel   102B Aug 18  2009 Font Book.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Front Row.app/
drwxrwxr-x   3 root         admin   102B Mar  6 21:08 GarageBand.app/
drwxr-xr-x@  3 root         wheel   102B Apr  2 17:01 Google Chrome.app/
        com.apple.FinderInfo      32B 
drwxrwxr-x   3 root         admin   102B Apr 25 23:23 Google SketchUp 7/
drwxr-xr-x   3 root         wheel   102B Feb 11 17:24 Image Capture.app/
drwxrwxr-x@ 20 baalexander  admin   680B Apr 10 11:02 MAMP/
        com.apple.FinderInfo      32B 
        com.apple.quarantine      42B 
drwxr-xr-x   3 baalexander  admin   102B Mar  5 08:48 MacVim.app/
drwxr-xr-x   3 baalexander  admin   102B Mar 29 12:06 MagicPrefs.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:41 Mail.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:40 Photo Booth.app/
drwxr-xr-x   3 root         wheel   102B Feb 11 18:29 Preview.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 QuickTime Player.app/
drwxr-xr-x   3 baalexander  admin   102B Apr 24 19:14 Rivet.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Safari.app/
drwxr-xr-x@  3 baalexander  admin   102B Feb  8 08:15 Skype.app/
        com.apple.quarantine      78B 
drwxr-xr-x   3 root         wheel   102B May 19  2009 Stickies.app/
drwxrwxr-x   3 root         wheel   102B Oct  1  2009 System Preferences.app/
drwxr-xr-x   3 root         wheel   102B Jun 29  2009 TextEdit.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 Time Machine.app/
drwxr-xr-x@  3 Admin        admin   102B Mar 22 13:52 Unison.app/
        com.apple.quarantine      42B 
drwxrwxr-x+ 28 root         admin   952B Mar  6 20:54 Utilities/
 0: group:everyone deny delete
drwxr-xr-x   3 root         wheel   102B Feb 11 18:40 iCal.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 iChat.app/
drwxrwxr-x   3 root         admin   102B Mar  6 21:08 iDVD.app/
drwxrwxr-x   3 root         admin   102B Apr 24 11:07 iMovie.app/
drwxrwxr-x   3 root         admin   102B Apr 24 11:07 iPhoto.app/
drwxr-xr-x   3 root         wheel   102B Sep 24  2009 iSync.app/
drwxr-xr-x   3 root         wheel   102B Apr 24 11:07 iTunes.app/

I decided to run

sudo xattr -d com.apple.quarantine /Applications/Firefox.app/

which resolved the issue. Yes, like the original post I linked to said. I still don't know why this is happening in the first place and seemingly only when I install an application as the Admin user.

 

[Detektiv-Pinky]

The @ indicates an extended file attribute and is indeed the cause of this behaviour because it indicates that this file has been downloaded. The attribute should be cleared automatically after first launch.

My guess is that since you put the file as admin into /Applications and run it as a 'normal' user, the user does not have the necessary permissions to reset the attribute.
Try running the program once as Admin and see if the message goes away.

 

[Middling]

Try running the program once as Admin and see if the message goes away.

That will remove the quarantine but it then kind of makes pointless trying to run as a standard user.

I was in much the same situation as the OP and for all the time i was on Leopard i would manually remove the quarantine bit from every download.

Then i found this hint which disables OS X's checking of the quarantine.

 

[Detektiv-Pinky]

That will remove the quarantine but it then kind of makes pointless trying to run as a standard user.

I was in much the same situation as the OP and for all the time i was on Leopard i would manually remove the quarantine bit from every download.

Then i found this hint which disables OS X's checking of the quarantine.

Why do you think it makes it running as a standard user useless?

I usually install software right from the 'non'-admin account that I regularly use. I get asked for my Admin password for installation and afterwards I am reminded once that I had downloaded this software from the Internet - not that big of an issue...

 

[holbla]

I just solved this problem on my fiancee's MBP. I discovered that I had placed the .dmg file that I had downloaded in her dock instead of the .app file that is copied to the applications folder (an easy mistake to make as both files have the same icon). This meant that every time she would open the app it would ask her permission to mount the disk image and run the app from there.

All I had to do was remove the .dmg from the dock and put the .app in it's place and the problem went away.

 

[Calamity J]

The @ indicates an extended file attribute and is indeed the cause of this behaviour because it indicates that this file has been downloaded. The attribute should be cleared automatically after first launch.

My guess is that since you put the file as admin into /Applications and run it as a 'normal' user, the user does not have the necessary permissions to reset the attribute.
Try running the program once as Admin and see if the message goes away.

I just wanted to bump this to say that this was my problem. Yesterday I installed Mountain Lion (workplace build) and created a new account. The account began as a standard user and I had to grant it administrative rights. Later I installed some applications using our software distribution portal (JAMF Self Service) and they would continually give me the "downloaded from the internet" warnings. Looking at the .app I noticed that Admin didn't have read/write rights.. they were set to read-only. I assume that this is a setting put in place (perhaps accidentally) by our admins... but changing the permission to fit the user is certainly how to fix it.

Thank you.