Why does defaults only read from files with certain extended attributes?

Question

It seems that defaults read only works on property list files in certain folders (e.g. Desktop, Downloads) when the extended attribute com.apple.macl contains a specific value otherwise it reports that the key does not exist.

Create a plist file containing a key foo with the value bar.

$ echo '''<?xml version="1.0" encoding="UTF-8"?>
> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
> <plist version="1.0">
> <dict>
>   <key>foo</key>
>   <string>bar</string>
> </dict>
> </plist>''' > ~/foobar.plist

Use defaults read to print the value of foo.

$ /usr/bin/defaults read ~/foobar.plist foo
bar

Copy the file from the home folder to the desktop.

$ cp ~/foobar.plist ~/Desktop

Trying to read the key with defaults there does not work, according to the error message because it does not exist.

$ /usr/bin/defaults read ~/Desktop/foobar.plist foo
2022-11-01 11:03:21.156 defaults[67556:1531405]
The domain/default pair of (/Users/stefan/Desktop/foobar.plist, foo) does not exist

PlistBuddy however reports correctly that key does in fact exist ( plutil also works fine).

$ /usr/libexec/PlistBuddy -c "print foo" ~/Desktop/foobar.plist
bar

The directory listing shows that the file on the desktop has an extended attribute.

$ ls -l ~/Desktop/foobar.plist
-rw-rw-r--@ 1 stefan  staff  228 Nov  1 11:03 /Users/stefan/Desktop/foobar.plist

The original file does not have an extended attribute.

$ ls -l ~/foobar.plist
-rw-rw-r--  1 stefan  staff  228 Nov  1 11:03 /Users/stefan/foobar.plist

The file on the desktop has the com.apple.macl attribute.

$ /usr/bin/xattr -l ~/Desktop/foobar.plist
com.apple.macl:
00000000  04 00 E7 04 31 F1 19 3B 41 2D BA 36 1D 05 19 2F  |....1..;A-.6.../|
00000010  D1 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00                          |........|
00000048

Copy the file from the desktop back to the home folder.

$ cp ~/Desktop/foobar.plist ~

The com.apple.macl attribute has been preserved on the copy.

$ /usr/bin/xattr -l ~/foobar.plist
com.apple.macl:
00000000  04 00 E7 04 31 F1 19 3B 41 2D BA 36 1D 05 19 2F  |....1..;A-.6.../|
00000010  D1 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00                          |........|
00000048

Reading the key from the file in the home directory works fine despite the presence of the com.apple.macl attribute.

$ /usr/bin/defaults read ~/foobar.plist foo
bar

Try to delete the com.apple.macl attribute from the file on the desktop.

$ /usr/bin/xattr -d com.apple.macl ~/Desktop/foobar.plist

The com.apple.macl attribute was not removed.

$ /usr/bin/xattr -l ~/Desktop/foobar.plist
com.apple.macl:
00000000  04 00 E7 04 31 F1 19 3B 41 2D BA 36 1D 05 19 2F  |....1..;A-.6.../|
00000010  D1 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00                          |........|
00000048

Try to delete the com.apple.macl attribute from the file in the home folder.

$ /usr/bin/xattr -d com.apple.macl ~/foobar.plist

The com.apple.macl attribute was removed.

$ /usr/bin/xattr -l ~/foobar.plist

In some way that I cannot remember I created another plist file that also had the com.apple.macl attribute but with a different value. The value of com.apple.macl starts with 04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1 FC BF and the rest is zeros.

Write the alternative value of the com.apple.macl attribute to the file in the home folder.

$ /usr/bin/xattr -wx com.apple.macl '04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1 FC BF' ~/foobar.plist

The value of com.apple.macl was correctly written.

$ /usr/bin/xattr -l ~/foobar.plist
com.apple.macl:
00000000  04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1  |..[.{...I..4.[..|
00000010  FC BF                                            |..|
00000012

Copy the file from the home folder back to the desktop.

$ cp ~/foobar.plist ~/Desktop

The value written to the com.apple.macl attribute is still present, but has been extended with the value 04 00 E7 04 31 F1 19 3B 41 2D BA 36 1D 05 19 2F D1 0F and zeros.

$ /usr/bin/xattr -l ~/Desktop/foobar.plist
com.apple.macl:
00000000  04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1  |..[.{...I..4.[..|
00000010  FC BF 04 00 E7 04 31 F1 19 3B 41 2D BA 36 1D 05  |......1..;A-.6..|
00000020  19 2F D1 0F 00 00 00 00 00 00 00 00 00 00 00 00  |./..............|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00                          |........|
00000048

Reading the key from the file on the desktop now works.

$ /usr/bin/defaults read ~/Desktop/foobar.plist foo
bar

What is happening here?

Why does defaults seemingly only read a key from a property list file in the Desktop folder when the extended attribute com.apple.macl contains a specific value?

Update

It seems when using defaults write to create the property list file the key is always found.

$ /usr/bin/defaults write ~/foobar.plist foo bar
$ /usr/bin/defaults read ~/foobar.plist foo
bar
$ /usr/bin/defaults write ~/Downloads/foobar.plist foo bar
$ /usr/bin/defaults read ~/Downloads/foobar.plist foo
bar
$ /usr/bin/defaults write ~/Documents/foobar.plist foo bar
$ /usr/bin/defaults read ~/Documents/foobar.plist foo
bar
$ /usr/bin/defaults write ~/Desktop/foobar.plist foo bar
$ /usr/bin/defaults read ~/Desktop/foobar.plist foo
bar

As above the extended attribute com.apple.macl is not present when the file is created in the home folder.

$ /usr/bin/xattr -l ~/foobar.plist

com.apple.macl gets assigned 04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1 FC BF when the file is created in the Documents or Downloads folder.

$ /usr/bin/xattr -l ~/Documents/foobar.plist
com.apple.macl:
00000000  04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1  |..[.{...I..4.[..|
00000010  FC BF 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00                          |........|
00000048

$ /usr/bin/xattr -l ~/Downloads/foobar.plist
com.apple.macl:
00000000  04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1  |..[.{...I..4.[..|
00000010  FC BF 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00                          |........|
00000048

com.apple.macl gets assigned 04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1 FC BF 04 00 E7 04 31 F1 19 3B 41 2D BA 36 1D 05 19 2F D1 0F when the file is created in the Desktop folder.

$ /usr/bin/xattr -l ~/Desktop/foobar.plist
com.apple.macl:
00000000  04 00 5B E7 7B 97 C0 D1 49 FF AD 34 CC 5B C3 B1  |..[.{...I..4.[..|
00000010  FC BF 04 00 E7 04 31 F1 19 3B 41 2D BA 36 1D 05  |......1..;A-.6..|
00000020  19 2F D1 0F 00 00 00 00 00 00 00 00 00 00 00 00  |./..............|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00                          |........|
00000048

---

^{This was tested on macOS Catalina 10.15.7}