Gatekeeper (macOS)
 |
|
| Developer(s) | Apple Inc. |
|---|---|
| Initial release | July 25, 2012 |
| Operating system | macOS |
Gatekeeper is a security feature of the macOS operating system by Apple. It enforces code signing and verifies downloaded applications before allowing them to run, thereby reducing the likelihood of inadvertently executing malware. Gatekeeper builds upon File Quarantine, which was introduced in Mac OS X Leopard and expanded in Mac OS X Snow Leopard. The feature originated in version 10.7.3 of Mac OS X Lion as the command-line utility spctl. A graphical user interface was added in OS X Mountain Lion and later also in version 10.7.5 of Lion.
In the security & privacy panel of System Preferences, the user has three options:
The command-line utility spctl provides granular controls, such as custom rules and individual or blanket permissions, as well as an option to turn Gatekeeper off.
Upon download of an application, a particular extended file attribute ("quarantine flag") can be added to the downloaded file. This attribute is added by the application that downloads the file, such as a web browser or email client. This behavior is disabled by default for third-party applications and developers need to opt into it. The system can also force this behavior upon individual applications.
When the user attempts to open an application with such an attribute, the system will delay the execution and verify whether it is:
Since Mac OS X Snow Leopard, the system keeps two blacklists to identify known malware or insecure software. The blacklists are updated periodically. If the application is blacklisted, then File Quarantine will refuse to open it and recommend to the user to move it to trash.
Gatekeeper will refuse to open the application if the code-signing requirements are not met. Apple can revoke the developer's certificate with which the application was signed and prevent further distribution.
...
Wikipedia