Extended attributes (xattr) contain a wide range of metadata, some of which are intended to persist with the file they’re attached to, others to be more transient. Depending on the type of file operation performed, macOS has an elaborate mechanism for determining which are preserved, and which are not. This article tries to explain how this works in macOS Tahoe 26.0.
Xattr flags
When first introduced in Mac OS X, no provision was made for xattrs to have type-specific preservation, and that was added later using flags suffixed to the xattr’s name. For example, the com.apple.lastuseddate xattr found commonly on edited files is shown with a full name of com.apple.lastuseddate#PS to assign the two flags P and S to it, and the most recent xattr com.apple.fileprovider.pinned, used to mark files in iCloud Drive that have been pinned, has the two flags P and X assigned to it for a the full name of com.apple.fileprovider.pinned#PX.
This is a kludge, because you normally have to refer to the xattr name including its flags, although the flags aren’t really part of its name. This can catch the unwary.
It’s further complicated by a set of system tables for some standard xattr types that don’t have flags suffixed, but are treated as if they do. One notable example of those is the quarantine xattr com.apple.quarantine, which is handled by macOS as if it has the PCS flags attached, although those are never used when referring to it by name.
There are also lower case flags that can be used to override those set in system tables, although those appear to be used exceedingly rarely, and I don’t recall ever coming across them. In theory, if you were using a new type based on the standard com.apple.metadata: family, com.apple.metadata:kMDItemNew, you could alter its behaviour to some similar types with the flags psB, as in com.apple.metadata:kMDItemNew#psB. I have no idea whether that would be respected in practice. For the rest of this article, I will ignore the existence of those lower case flags.
Intents
File operations involving decisions about the preservation of xattrs are simplified into the following intents:
copy – simply copying a file from a source to a destination and preserving its data, such as using cp, is labelled XATTR_OPERATION_INTENT_COPY
save – saving a file when probably changing its content, including performing a ‘safe save’; this may over-write or replace the source with the saved file. Some xattrs shouldn’t be preserved in this process of XATTR_OPERATION_INTENT_SAVE
share – sharing or exporting this file, perhaps as an attachment to email, or placing the file in a public folder. Some sensitive metadata shouldn’t be preserved in XATTR_OPERATION_INTENT_SHARE
sync – syncing the file to a service such as iCloud Drive, in XATTR_OPERATION_INTENT_SYNC
backup – backing the file up, perhaps using Time Machine, in XATTR_OPERATION_INTENT_BACKUP.
Flags
As of macOS 15.0 (including 26.0), the following flags are supported:
C: XATTR_FLAG_CONTENT_DEPENDENT ties the flag with the file contents, so the xattr has to be recreated when the file data changes. This may be appropriate for checksums and hashes, text encoding, and position information. The xattr is then preserved for copy and share, but not in a safe save.
P: XATTR_FLAG_NO_EXPORT doesn’t export or share the xattr, but preserves it during copying.
N: XATTR_FLAG_NEVER_PRESERVE ensures the xattr is never preserved, even when copying the file.
S: XATTR_FLAG_SYNCABLE ensures the xattr is preserved during syncing with services such as iCloud Drive. Default behaviour is for xattrs to be stripped during syncing, to minimise the amount of data to be transferred, but this flag overrides that.
B: XATTR_FLAG_ONLY_BACKUP keeps the xattr only in backups, including Time Machine, where there’s no desire to minimise what’s backed up.
X: XATTR_FLAG_ONLY_SAVING keeps the xattr only when saving and in backups, including Time Machine (macOS 15.0 and later only).
There’s another system limit that must be adhered to: total length of the xattr name including any # and flags cannot exceed a maximum of 127 UTF-8 characters.
System tables
These are hard-coded in source, where * represents a ‘wild card’:
com.apple.quarantine – PCS preserved in copy, sync, backup
com.apple.metadata:kMDItemCollaborationIdentifier – B backup
com.apple.metadata:kMDItemIsShared – B backup
com.apple.metadata:kMDItemSharedItemCurrentUserRole – B backup
com.apple.metadata:kMDItemOwnerName – B backup
com.apple.metadata:kMDItemFavoriteRank – B backup
com.apple.metadata:* (except those above) – PScopy, save, sync, backup
com.apple.security.* – S or N depending on sandboxing, see below
com.apple.ResourceFork – PCScopy, sync, backup
com.apple.FinderInfo – PCScopy, sync, backup
com.apple.root.installed – PCcopy, backup.
System defaults for com.apple.security.* depend on whether the app performing the file operation is running in an app sandbox. Non-sandboxed apps apply S to preserve the xattr for copy, save, share, sync, backup; for sandboxed apps N is applied so the xattr is never preserved, even when copying the file.
Flags and intents
We can now revisit the list of intents, and establish the effects of xattr flags on each, as:
XATTR_OPERATION_INTENT_COPY preserves xattrs that don’t have flag N or B or X
XATTR_OPERATION_INTENT_SAVE preserves xattrs that don’t have flag C or N or B
XATTR_OPERATION_INTENT_SHARE preserves xattrs that don’t have flag P or N or B or X
XATTR_OPERATION_INTENT_SYNC preserves xattrs if they have flag S, or have neither N nor B
XATTR_OPERATION_INTENT_BACKUP preserves xattrs that don’t have flag N.
Finally, Apple provides separate information on how xattrs are synced by FileProvider, for iCloud Drive and third-party cloud services using that API. This confirms that the S flag should sync a xattr, but is vague on other flags, simply stating “some older attributes are also synced”. However, a cap is applied on the maximum size of xattrs that are syncable, at “about 32KiB total for each item”. If the xattrs exceed that limit “the system automatically makes some of the attributes nonsyncable.” More puzzlingly, it states “the resource fork is content and isn’t included in the extended attributes dictionary.”
Conclusions
Controls over the preservation of xattrs are appended as tags to their name, following a hash #. In most circumstances, they should be treated as part of that xattr’s name, and are required for commands and actions on that xattr, for example when using the xattr command. They should also be left intact and not removed, unless you want to change the behaviour of that xattr in file operations.
Most xattrs commonly used by macOS don’t explicitly use tags, but are governed by a hard-coded system table that can’t be changed.
When using standard commands such as cp, macOS will automatically apply these rules when deciding whether to preserve xattrs. However, using a command for a different intent, such as cp for backing up, won’t normally invoke the behaviour you might want.
Code using standard macOS file operations should follow the behaviour expected for its intent, and shouldn’t require any special handling of xattrs. Lower-level operations are likely to differ, though, and may require implementation of equivalent behaviours.
Those implementing their own xattr types should incorporate flags explicitly to ensure they’re preserved as intended.
In cases of uncertainty, for example when working with files stored in iCloud Drive, you’ll need to step carefully through the rules above.
Sources
xattr_flags.h, xattr_flags.c, xattr_properties.h in copyfile source, e.g. at Apple’s OSS Distributions Github
man xattr_name_with_flags(3), included in copyfile source FileProvider (Apple).
The funeral for Rabbi Eli Schlanger on Wednesday was the first held for one of the 15 people killed in a mass shooting at a Jewish celebration in Sydney, Australia.
BBC outside Rabbi Schlanger's funeral as mourners pay tribute
The first funeral for one of the victims of the Bondi Beach shooting has taken place in Sydney, with thousands gathering to mourn Rabbi Eli Schlanger.
He was among 15 people killed when two gunmen, alleged to have been motivated by Islamic State ideology, opened fire on a festival marking the first day of Hanukkah.
Rabbi Schlanger, who was known as the "Bondi Rabbi" and had helped organise Sunday's event, was born in the UK. His wife gave birth to their fifth child just two months ago.
Rabbi Levi Wolff, who opened the service, said his death as an "unspeakable loss" for the community, the Chabad of Bondi and "the entire Jewish nation".
Associated Press
The family of Rabbi Eli Schlanger mourn over his coffin during his funeral
"Eli was ripped away from us, doing what he loved best," he said.
"Spreading love and joy and caring for his people with endless self-sacrifice in his life and in his death, he towered above as one of the highest and holiest souls."
He was mourned by his father-in-law as a person beloved by the community. The 41-year-old was "my son, my friend, my confidant," Rabbi Yehoram Ulman told the congregation at the Chabad of Bondi.
"My biggest regret was, apart from the obvious, to tell Eli more often how much we love him, how much I love him, how much we appreciate everything that he does and how proud we are of him," Rabbi Ulman said.
"I hope he knew that but I think it should have been said more often."
Ulman also urged Jewish people not to hide in the aftermath of the attack and said that on Sunday night - the final night of Hanukkah - they would continue a 31-year-old tradition, and light the final candle on Bondi Beach.
"All the rabbis together, under the banner of our Chabat house of Bondi, to which Eli dedicated his life, we are going to gather in Bondi Beach," he said.
The funeral of Rabbi Yaakov Levitan is also expected to take place on Wednesday afternoon, while the funeral of 10-year-old Matilda, the youngest victim, is to take place on Thursday.
Speaking to reporters in Bondi on Wednesday, Matilda's father praised lifesavers, bystanders and police officers who came to their assistance as they struggled to save their daughter's life, and a woman who helped their younger daughter, Summer.
"I must say the biggest thank you to the lady that saved Summer," he said. "I don't know who she was but she literally hugged her for the whole ten minutes of shooting."
Watch: 10-year-old victim's parents speak at Bondi flower tribute
Opposition leader Sussan Ley, New South Wales Premier Chris Minns, former prime minister Scott Morrison and Israeli Ambassador Amir Maimon were among those attending Schlanger's funeral.
Anthony Albanese was not present. Asked on ABC NewsRadio about his absence, the prime minister said, "I would attend anything that I'm invited to. These are funerals that are taking place to farewell people's loved ones."
The Jewish community has criticised Albanese for not taking enough action on antisemitism.
The prime minister defended himself against those accusations on Wednesday, telling ABC NewsRadio he had taken a series of measures including appointing the country's first antisemitism envoy, toughening hate speech laws and increasing funding for social cohesion projects and Jewish institutions.
He also said that one of the two men accused of carrying out Sunday's attack would be charged later on Wednesday, although NSW Police Commissioner Mal Lanyon later said this may depend on his medical condition.
"It's important he has appropriate cognitive ability. For his fairness, we need him to understand what is exactly happening," he told reporters in Sydney.
Naveed Akram reportedly woke from a coma on Tuesday afternoon after being shot and critically injured by police in Sunday's attack. His father, 50-year-old Sajid Akram was shot dead.
The pair, who allegedly fired on people attending the Hanukkah festival for around 10 minutes, reportedly travelled to the Philippines in November and police are investigating whether they met with Islamic extremists.
Two police officers were critically injured in the shooting and police on Wednesday confirmed that one of them had lost the sight in one eye as a result.
Jack Hibbert, 22, had only been in the police force for four months when he was shot, police said in a statement. During the attack he had "responded with courage, instinct, and selflessness, continuing to protect and help others whilst injured, until he was physically no longer able to."
The second officer, constable Scott Dyson, underwent further surgery this morning and is in a critical but stable condition, Lanyon added.
The Met Office has announced that 2025 has been the sunniest year in the UK since records began in 1910.
With two weeks of the year still to go, provisional data shows that 1622 hours of sunshine have been recorded, beating the previous record set back in 2003.
All months this year excluding February and October recorded above average sunshine hours.
The record-breaking sunny year was bolstered by an exceptional spring, which was not only the sunniest and warmest on record, but also the driest in more than 50 years.
Where were the sunniest spots?
Whilst the UK as a whole has seen well above average sunshine hours this year, there have been some big regional differences.
Looking at the data for the four nations separately, only England has broken its record for the sunniest year, whilst 2025 is currently the second sunniest year in Scotland and the sixth sunniest in Wales.
In Northern Ireland, although sunshine has been above average in 2025, it is currently not in the top 10 sunny years on record - but may come close by the end of December.
The most notably high sunshine amounts, compared to average, were recorded in eastern England and northern Scotland.
Image caption,
Frequent high pressure in 2025 blocked areas of cloud and rain from reaching the UK
Why has there been so much sunshine this year?
High pressure has been a frequent feature of 2025's weather.
Areas of high pressure form as air descends in the atmosphere, leading to largely dry and settled weather. Depending on the exact location of the high, and the time of year, this can bring sunny skies that last several days.
The behaviour of the jet stream influences where high and low pressure systems form. During 2025 the jet stream has often been positioned well to the north of the UK, allowing higher pressure to build to the south, across the UK, blocking rain-bearing weather fronts from reaching our shores.
How is sunshine measured?
Sunshine hours are measured and recorded, external at nearly 300 Met Office observing sites across the UK. Two types of instrument are used: either a Campbell-Stokes sunshine recorder or a modern sunshine duration detector.
"Sunshine" is recorded when the strength of the Sun is at least 120 watts per square metre. When passing clouds obscure the Sun, the strength typically dips below this threshold.
Image caption,
Sunshine amounts compared to average in 2025 (left) and in 2024 (right)
Is climate change bringing more sunshine?
Whilst we know that climate change is influencing our weather in several ways - higher temperatures, wetter winters and drier summers - the link between climate change and sunshine is still unclear.
The Met Office says, "The UK has generally become sunnier since the 1980s.The cause of this trend is uncertain and it may simply be down to natural variability, though reduced aerosols could be a factor."
The past few years have seen huge variability in sunshine amounts, with 2024 being the dullest year since 1998, followed by 2025, which will go down as the sunniest year on record.
Will the sunny theme continue into the start of 2026?
Although 2025 has been an exceptionally sunny year overall, it is worth noting that recent months haven't been quite so bright. In fact autumn was actually slightly duller than average and December has seen around average sunshine so far.
As we head towards the new year, there are signals of a return to the influence of high pressure, which could bring with it sunny skies at times, although during the winter months, high pressure can trap cloud and moisture - something called anticyclonic gloom.
Keep up to date with our latest thoughts on the longer-range forecast in our monthly outlook or by downloading the BBC Weather app.
In the interview, Wiles describes Donald Trump as having an "alcoholic's personality" and JD Vance as having been a "conspiracy theorist" for a decade.
Login
