2 ms·
I always wished for Mac OS or Unix in general to have a way to ‘stamp’ files with the application bundle id that created the file. Something in extended attribu
by adamomada 4y ago
I always wished for Mac OS or Unix in general to have a way to ‘stamp’ files with the application bundle id that created the file. Something in extended attributes, just like the quarantine tag that records where a download came from.
Does anyone have any idea on how you could make a wrapper that would be able to do this? If that’s possible, the next step would be to figure out how to have launchd use the wrapper. Or even better, swap out the Application.app with the wrapper and make the actual application hidden like .Application.app, or inside the wrapper, or …?
The wrapper would stamp itself and the original with the bundle id so when you do a find on the xattr of the bundle you get a definitive list of every last trace of everything on the filesystem related to the application.
Perhaps the wrapper would have a special case of documents created and saved in normal user home directories, so e.g. your ~/Documents/todo.txt created in MacVim doesn’t get the macvim tag
The reason for all this?
Some commercial software offers a trial and some licensing systems out there spew obfuscated files in weird places, that aren’t easily identified as belonging to the app or the licensing framework.
- dervjd 4y agoRegarding the very last line of your comment - I use BlockBlock (https://objective-see.com/products/blockblock.html https://objective-see.com/products/blockblock.html) on every Mac to catch/stop software installing weird startup/background agents. Might be worth checking out.