My Mac App Store utility removes Mac metadata files (._* AppleDouble files and .DS_Store) from external drives formatted exFAT or FAT32. The app is sandboxed with com.apple.security.files.user-selected.read-write and com.apple.security.files.bookmarks.app-scope. The user grants access to the volume through NSOpenPanel.
Deleting a ._ file works, except when its companion file carries com.apple.quarantine (for example, a file downloaded with Safari and copied to the drive with Finder). Then:
let partner = volume + "/Nirvana.zip" // has com.apple.quarantine
let appleDouble = volume + "/._Nirvana.zip"
removexattr(partner, "com.apple.quarantine", XATTR_NOFOLLOW) // -1, errno 1 (EPERM)
unlink(appleDouble) // -1, errno 1 (EPERM)
The same unlink succeeds from Terminal (not sandboxed, without Full Disk Access). On exFAT the extended attributes live in the ._ file, so I assume the sandbox refuses because deleting it would remove the quarantine attribute.
Tried, with no change:
- Full Disk Access granted to the app.
- Adding
com.apple.security.files.user-selected.executable(verified in the built app withcodesign -d --entitlements -).
On a real drive (a music library), about 71% of the ._ files belong to quarantined files, so this is most of what users want removed.
Is there a supported way for a sandboxed app to remove these files: an entitlement, an API, or an explicit user action? If not, can you confirm it's intended behavior, so I can explain it accurately to users?
macOS 27.2, Xcode 27.2, Apple silicon. Focused sample project available (one source file). DTS case 23240704.