Why does macOS set xattr com.apple.quarantine, when saving a shell script on a usb stick

Question

Problem

macOS sets xattr com.apple.quarantine, when I edit and save the file myscript.sh on a usb stick

We're on the USB stick

[stick128] pwd
/Volumes/stick128

The textfiles xattributes before being edited

[stick128] ls -la@ myScript.sh 
-rwxrwxrwx@ 1 schmelzer  staff  28 22 Okt 02:16 myScript.sh
com.apple.metadata:kMDLabel_vmtpkn3xxtzmlwr5m34qap3z4a  185 

The textfiles xattributes after being edited and saved

[stick128] ls -la@ myScript.sh 
-rwxrwxrwx@ 1 schmelzer  staff  30 22 Okt 02:20 myScript.sh
com.apple.quarantine    24 
com.apple.metadata:kMDLabel_vmtpkn3xxtzmlwr5m34qap3z4a  201 

Cause

??

Temporary Solution

Remove the xattr manually

xattr -d com.apple.quarantine myscript.sh

Thanks to -bash: Applications/mvim: /bin/sh: bad interpreter: Operation not permitted

But he next time, I edit the file, the xattr get's added again by whom?

• by the texteditor?
• by macOS (as part of the SIP System?)

My Environment

• macOS Sierra, Version 10.12.6
• Texteditor: CotEditor, Version Version 3.2.2 (203)
• USB Stick: SanDisk 128GB Connect Wireless Stick, plugged into the USB Port

My research 1

Q: Is the problem only on the USB stick? Or is it on my harddisk, too?

A: Problem is not on the harddisk. Only on the USB stick

Details for research 1 We're on the macs harddisk, where macos is installed

[Desktop] pwd
/Users/schmelzer/Desktop

The textfiles xattributes before being edited

[Desktop] ls -la@ myScript.sh 
-rwxrwxrwx@ 1 schmelzer  staff  30 22 Okt 02:20 myScript.sh
com.apple.metadata:kMDLabel_vmtpkn3xxtzmlwr5m34qap3z4a  201 

The textfiles xattributes after being edited and saved

[Desktop] ls -la@ myScript.sh 
-rwxrwxrwx@ 1 schmelzer  staff  28 22 Okt 02:25 myScript.sh
com.apple.metadata:kMDLabel_vmtpkn3xxtzmlwr5m34qap3z4a  201 

Testresult

The quarantine xattr has not been added to the file. Thus the problem does not exist on the harddisk. Only on the usb stick.

My research 2

Q: Is there a file with the quarantine flag set, on the USB stick? mount is adding a quarantine flag, causing: /bin/bash: bad interpreter: Operation not permitted - but not the usual suspects

A: Yes, there were many.

Details for research 2

List xattributes of all files on the stick

xattr -r /Volumes/stick128/

Remove the xattribute com.apple.quarantine from all files on the USB stick

sudo xattr -r -d com.apple.quarantine /Volumes/stick128

Try provoking the error again, by editing and saving the myScript.sh file

Result

• No error
• The xattr com.apple.quarantine is not beeing added to myScript.sh

My research 3

Q: When I use a different Texteditor, does the problem remain the same? mount is adding a quarantine flag, causing: /bin/bash: bad interpreter: Operation not permitted - but not the usual suspects

A: Not tested

My research 4

Just for reference:

• This post describes the "bad interpreter: Operation not permitted” Error", which happens, when you try to execute a shell script with the xattr quarantine flag set.
• -bash: Applications/mvim: /bin/sh: bad interpreter: Operation not permitted

Answer 1

This solved it for me

Q: Is there a file with the quarantine flag set, on the USB stick? mount is adding a quarantine flag, causing: /bin/bash: bad interpreter: Operation not permitted - but not the usual suspects

A: Yes, there were many.

Howto do it

List xattributes of all files on the stick

xattr -r /Volumes/stick128/

Remove the xattribute com.apple.quarantine from all files on the USB stick

sudo xattr -r -d com.apple.quarantine /Volumes/stick128

Try provoking the error again, by editing and saving the myScript.sh file

Result

• No error
• The xattr com.apple.quarantine is not beeing added to myScript.sh