9

I can download applications from custom websites, and run them, even when my gatekeeper settings are at "AppStore Only". This is my application -- it's not even signed.

What could be the reason for that? I can reproduce this behavior on all my 3 macs.

  • 2
    How are you downloading and expanding the apps? – Gordon Davisson Mar 22 '13 at 19:55
  • via a smb://server file location. copying them over to my desktop. On other machines, this triggers the safety mechanisms correcrly. On my machines, even though I have "AppStore Only", taking the same file, the same way is allowable, no restrictions for installing and running. Mystery. – JasonGenX Mar 27 '13 at 13:58
  • 2
    What happens if you download the same file over http? – stuffe Mar 27 '13 at 23:47
7
+300

This is a status-by-design feature where an admin user can always override Gatekeeper and open an Application by right clicking the app in Finder.

An admin user can also change Gatekeeper settings or disable it entirely, so there's no real harm (in my eyes at least) in presenting a one-time white list dialog to ensure the admin user intends to allow a non-compliant (non-signed or non-Mac App Store) application to run.

Apple's training dialog for Gatekeeper - from support.apple.com/kb/HT5290

Now if you found a way for a non-admin user to bypass Gatekeeper, then I would expect filing a security vulnerability with Apple to get credit for finding a hole once they patch whatever implementation error was made to allow out of policy apps to run.

Apple documents this feature in depth on how to explicitly white list an application.

Gatekeeper is not malware protection and not a black list. It is a set of policies that allow first launch of properly signed applications and or validation of Mac App store receipts. If an admin user explicitly launches and then approves the running of non-compliant software, you have an education or policy problem as opposed to uncovering some flaw in Gatekeeper.

In detail, I have summarized (and mostly copied) the relevant sections of Apple's help on white listing any App so that Gatekeeper will allow it to run unhindered and unprompted:

How to open an app from a unidentified developer and exempt it from Gatekeeper

If you are confident the app downloaded from the Internet is the latest version and is from a source you trust, you can open an app from an unidentified developer by following these steps.

Important: Some Apple screened apps from developers that are in the process of acquiring Developer ID signatures will present the "Open" option when they are double-clicked.

Note: In most cases, you will only have to perform these steps once for all user accounts on the Mac:

  • In Finder, Control-click or right click the icon of the app.
  • Select Open from the top of contextual menu that appears.
  • Click Open in the dialog box. If prompted, enter an administrator name and password.

Note: If there is an app that presents multiple Gatekeeper dialog boxes, you can temporarily use Gatekeeper's "Always" option. Make sure to restore the Gatekeeper option that was there before to bring back Gatekeeper function.

You can easily control who can white list Applications by not handing out Administrator user names and passwords to users that are not aware of this functionality and you also can manage gatekeeper from the terminal or profile manager and other managed settings software like Casper from JAMF. You can also audit your machines for software that has been white listed to periodically reset the list of allowed apps and determine who is exercising this function in case you wish to change policy and habit.

  • is there a setting that resets this one-time dialog? is this per application? how are apps identified? name? path? if I have chose to open "MyApp.app" once, will all next downloads and installations of "MyApp.app" succeed regardless of the GateKeeper settings? – JasonGenX Mar 28 '13 at 15:34
  • Each user has different rules that get stored in /var/db/SystemPolicy - so you would be a bit heavy handed to wipe that and start over, but you can remove specific rules with spctl so spctl --assess -v /Applications/Whatever.app would show you if it's allowed or rejected and spctl --remove /Applications/Whatever.app would reset the "dialog" and status for a specific application. I use a tool to collect all the apps on systems so that I can audit usage and correct things when needed with a short script. – bmike Mar 28 '13 at 16:56
  • However, according to Gordon's answer this also depends on the quarantine bit being set, so just because GateKeeper doesn't have a white list entry (or it gets removed), the quarantine bit needs to be reset or the app deleted to renew the "gatekeeper" dialog box and open protections. – bmike Mar 28 '13 at 16:59
10

Downloading a file over SMB will not trigger quarantining, and since the app is not quarantined the gatekeeper policy never gets checked. I'm not sure why it's being marked as quarantined on your other computers...

To check for quarantining at any point, use the ls -ld@ command to look for the com.apple.quarantine attribute:

$ ls -ld@ /Applications/TextWrangler.app
drwxrwxr-x@ 3 gordon  staff  102 Apr 30  2012 /Applications/TextWrangler.app
    com.apple.FinderInfo     32 
    com.apple.quarantine     57 

If that quarantine attribute is attached to the app, the gatekeeper policy will be checked; if not, it won't. The interesting question is why it got quarantined on your other computers, and if you use this command to check the application at various points as you distribute it, you can figure out when the attribute is getting attached (and therefore why it's getting attached).

EDIT: There's a note relating to this in the "Click here for more details" section of Apple's KB article #HT5290:

Important: Developer ID signature applies to apps downloaded from the Internet. Apps from other sources, such as file servers, external drives, or optical discs are exempt, unless the apps were originally downloaded from the Internet.

  • Gatekeeper is distinct from quarantine although together they help protect from accidental running of new software that isn't signed and/or not from the Mac App Store. See my answer for details. – bmike Mar 27 '13 at 18:08
  • 1
    @bmike: Actually, gatekeeper is an extension of the quarantine system; if you download an app, then run xattr -d com.apple.quarantine on it you can open it even if it violates gatekeeper policy. – Gordon Davisson Mar 27 '13 at 23:05
  • You can already open any app that violates gatekeeper policy. You just get (potentially an admin dialog and) then the chance to white list out of policy apps. Are you saying that a non-admin user could issue one command will bypass the check if you have Mac App Store only or signed only apps? – bmike Mar 27 '13 at 23:20
  • 1
    @bmike: Yep, I just tested downloading, dequarantining, and running an unsigned app from a non-admin account and it worked fine despite Gatekeeper being set to Mac App Store only mode. But I wouldn't consider this a significant security hole, since if a miscreant can talk a user into running a command like this, they can talk them into anything, and the user is doomed anyway (and since they're not an admin, all they can damage is their own account). – Gordon Davisson Mar 28 '13 at 0:16
  • 1
    This. Quarantine is not the same as Gatekeeper, but Gatekeeper relies on the metadata from Quarantine, which is attached to downloaded files as extended attribute metadata. If I could award the bounty, I'd award it here. – Daniel Apr 2 '13 at 13:52
4

If you have enabled this hidden preference, it also disables Gatekeeper:

defaults write com.apple.LaunchServices LSQuarantine -bool false

Or OS X allows opening all applications regardless of the setting in System Preferences.

  • Oops, I completely missed this and posted the same thing as a separate answer. Deleting now… – TJ Luoma Mar 28 '13 at 1:25
2

Gatekeeper prevents apps from being run by double-clicking, but you can always override it by selecting Open from the context menu.

If you can run downloaded unsigned apps by double-clicking, this is a problem with Gatekeeper. Files store their quarantine status in an extended attribute called com.apple.quarantine. If this attribute is cleared for some reason from your downloaded files, Gatekeeper will treat downloaded files as being no different from any other files on your computer. So I'd suggest that downloading a program and then using xattr -l filename in Terminal would be a good diagnostic tool if you have Xcode installed.

If you run them via the Open command from a menu, this is the designed behavior. Note that once you have run a program from the menu, it is forever enabled to be run by double-clicking, regardless of your Gatekeeper settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .