what is "xattr" and why do some files have one?

[jdw13]

This is observed from the zsh shell on MacOS Monterey.

Can some explain what I have done so that some files created from shell or emacs have an extended attribute and others do not?
I don't think I have done anything to make this happen. I find some have
com.apple.metadata:_kMDItemUserTags: bplist00
and others do not. Is bplist00 something personal to me or is it on all MacOS Monterey?
AFAIK, I have never used or tired to use any file extended attributes.
Most have been created from emacs, and some may have been copied from other files.

My MacOS sees to not have man page for "removexattr" nor is this command in my path.
Is the "xattr" just some Finder side effect seen in the shell?

 

[Grumpus]

While in your home directory, if you run

ls -l@

or

xattr -l *

you'll probably find that there are several files and directories which have extended attributes.

I don't think that bplist00 is specific to you, and based on some quick googling I'd guess that it's something to do with binary property lists.

removexattr is a system call, not a program, and it's a safe bet that xattr -d and xattr -c invoke removexattr to delete a single attribute or clear all attributes of a file respectively.

man 2 removexattr

 

[jdw13]

Thanks I made the following observation that may explain why some files have the latter and some do not. A file created under XQuartz has the attribute but one from iTerm2 shell or Terminal does not.
$ ls -ltr touch* -rw-r--r--@ 1 jw staff 0 Dec 5 20:54 touch_xterm -rw-r--r-- 1 jw staff 0 Dec 5 20:54 touch_iTerm2 -rw-r--r-- 1 jw staff 0 Dec 5 20:57 touch.Terminal jwMini: ([B]Downloads[/B]) /Users/jw/Downloads $

 

[gilby101]

Howard Oakley has a series of blog posts regarding xattrs. Start here https://eclecticlight.co/2017/12/11/an-introduction-to-extended-attributes-xattrs/ for an introduction.

 

[Grumpus]

Howard Oakley has a series of blog posts regarding xattrs. Start here https://eclecticlight.co/2017/12/11/an-introduction-to-extended-attributes-xattrs/ for an introduction.

That's very helpful, thank you.

 

[joevt]

This is observed from the zsh shell on MacOS Monterey.

Can some explain what I have done so that some files created from shell or emacs have an extended attribute and others do not?
I don't think I have done anything to make this happen. I find some have
com.apple.metadata:_kMDItemUserTags: bplist00
and others do not. Is bplist00 something personal to me or is it on all MacOS Monterey?
AFAIK, I have never used or tired to use any file extended attributes.
Most have been created from emacs, and some may have been copied from other files.

My MacOS sees to not have man page for "removexattr" nor is this command in my path.
Is the "xattr" just some Finder side effect seen in the shell?

bplist00 is just the beginning of that attribute. The command you used to list the attributes only showed the ascii text parts. Most attributes contain mostly binary data.

You can show the data of all the attributes as hex:
xattr -lx *

You can extract an attribute's data as hex and convert it to binary data (using xxd -p -r) and if it's a plist then you can dump the result with plutil.
xattr -px com.apple.metadata:kMDItemWhereFroms chud4.6.2.dmg | xxd -p -r | plutil -p -