Provided by: NAME vfsfruit - Enhanced OS X and Netatalk interoperability SYNOPSIS vfs objects = fruit DESCRIPTION This VFS module is part of the (7) suite. The vfsfruit module provides enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. The module should be stacked with vfscatia if enabling character conversion and must be stacked with vfsstreamsxattr, see the example section for the correct config. The module enables alternate data streams (ADS) support for a share, intercepts the OS X special streams 'AFPAfpInfo' and 'AFPResource' and handles them in a special way.

All other named streams are deferred to vfsstreamsxattr which must be loaded together with vfsfruit. Having shares with ADS support enabled for OS X client is worthwhile because it resembles the behaviour of Apple's own SMB server implementation and it avoids certain severe performance degradations caused by Samba's case sensitivity semantics. The OS X metadata and resource fork stream can be stored in a way compatible with Netatalk 3 by setting fruit:resource = file and fruit:metadata = netatalk.

OS X maps NTFS illegal characters to the Unicode private range in SMB requests. By setting fruit:encoding = native, all mapped characters are converted to native ASCII characters. Finally, share access modes are optionally checked against Netatalk AFP sharing modes by setting fruit:locking = netatalk. This module is not stackable other then described in this manpage.

The other day I was messing with some files that had the extended attribute com.apple.quarantine on them. I am aware of its purpose, but I have always been curious what the properties below meant when you output its values.

Vfs_fruit Uses Wrong Xattr Name For Machine

When I typed in xattr -p com.apple.quarantine xmlrpc.php for a file that has the said xattr, I get output like this: 0083;59b926ad;Safari.app;55847AA4-5562-42A2-89A7-8FAD394B455C What do the first 4 digits represent? 0083 Google hasn't brought up anything good and there are a few guides I found from users also trying to figure out what these numbers precisely represent.

As you're probably already aware, the quarantine flags are set when an agent (browser, mail client etc) saves a file to your machine. This is responsible for the warning that appears when you first try to open an application that was downloaded from the internet. All this information is stored and there's a complete history for every user. The first 4 digits are a set of flags that I expect are defined in quarantine.h, which appears to be a private header included in, within Apple's open source code.

These flags represent states, such as whether the file is quarantined or not. On closer analysis, the kernel extension quarantine.kext is responsible for handing this and upon disassembly, we can see the function quarantinegetflags. Here's just a snippet of the disassembled kext Note the formatting of the xattr output's first 4 flags with sscanf(rbx, '%04x;') 0x1) This calls quarantinegetinfo. We can see here that the flags denote various states of the file on the system, with vfs being the Virtual File System and vnode is the basic representation structure of a file.

Vfs_fruit Uses Wrong Xattr Name For Machines

As for the rest of the xattr output, each user has a local sqlite3database that keeps a record of every item downloaded. Its location is /Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 The database has just one table LSQuarantineEvent.

Vfs_fruit Uses Wrong Xattr Name For Machine

You can read all the data by using the sqlite3 command in the terminal sqlite3 /Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'select. from LSQuarantineEvent;' If you filter the results (grep or alternative) you'll be able to match up the GUID that makes up the latter part of the xattr output and you'll see all the information about that particular download, including which agent was responsible for downloading the file and even the URL from where it was retrieved.