How to trace what is re-entering jet.com super-cookie

cookiessafari

In Safari (Version 10.1.1 (10603.2.5)) on OS X Yosemite, in the Preferences… -> Privacy [Manage Website Data…] I have an entry:

jet.com
Databses

If I delete this entry, it disappears, and returns in two seconds or less, even with no other windows open, certainly none open to jet.com, and even with Cookies and website data set to Always Block. Any ideas how to trace what is re-entering this super-cookie?

Best Answer

You can use a command line utility called fs_usage to find out which application is accessing a file.

To keep an eye on the files stored for this "jet.com" entry the following command will show all activity on all files that contain "https_jet.com" in the file name or path.

sudo fs_usage -f filesystem | grep "https_jet.com"

I'd recommend running this command and trying to delete the entry again. You'll be prompted for your password because of the sudo command at the beginning, but that's necessary because fs_usage needs elevated root permissions. To cancel the command once you think you have enough information hold down CTRL and hit C.

For example while running that command and removing the entry using Safari's preference pane I get the following entries, which shows activity from Safari, WebKit, dbfseventsd and fseventsd on these files. If the removal of these files is being prevented or if something is recreating them, I'd expect you to see something that might help you identify the culprit.

00:58:59  unlink            /Users/alistair/Library/WebKit/MediaKeys/https_jet.com_0                         0.000010   Safari      
00:58:59  getattrlist       /Users/alistair/Library/WebKit/MediaKeys/https_jet.com_0                         0.000003   Safari      
00:58:59  rmdir             /Users/alistair/Library/WebKit/MediaKeys/https_jet.com_0                         0.000002   Safari      
00:58:59  unlink            /Users/alistair/Library/WebKit/MediaKeys/https_jet.com_0                         0.000002   Safari      
00:58:59  getattrlist       /Users/alistair/Library/WebKit/MediaKeys/https_jet.com_0                         0.000002   Safari      
00:58:59  rmdir             /Users/alistair/Library/WebKit/MediaKeys/https_jet.com_0                         0.000002   Safari      
00:58:59  open              /Users/alistair/Library/Safari/Databases/___IndexedDB/https_jet.com_0            0.000042   com.apple.We
00:58:59  getattrlist       /Users/alistair/Library/Safari/Databases/___IndexedDB/https_jet.com_0            0.000003   com.apple.We
00:58:59  rmdir             /Users/alistair/Library/Safari/Databases/___IndexedDB/https_jet.com_0            0.000003   com.apple.We
00:58:59  open              /Users/alistair/Library/Safari/Databases/___IndexedDB/https_jet.com_0            0.000004   com.apple.We
00:58:59  getattrlist       /Users/alistair/Library/Safari/Databases/___IndexedDB/https_jet.com_0            0.000002   com.apple.We
00:58:59  rmdir             /Users/alistair/Library/Safari/Databases/___IndexedDB/https_jet.com_0            0.000002   com.apple.We
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000008   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000002   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000013   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-wal     0.000006   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-wal     0.000002   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-shm     0.000002   Safari      
00:58:59  stat64            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000025   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000005   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000003   Safari      
00:58:59  unlink            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000194   Safari      
00:58:59  unlink            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-wal     0.000271   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-shm     0.000004   Safari      
00:58:59    HFS_update      /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-shm     0.000003   Safari      
00:58:59  unlink            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-shm     0.000070   Safari      
00:58:59  stat64            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000006   Safari      
00:58:59  stat64            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-wal     0.000004   Safari      
00:58:59  stat64            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-shm     0.000003   Safari      
00:58:59  access            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-shm     0.000020   dbfseventsd 
00:58:59  access            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-wal     0.000004   dbfseventsd 
00:58:59  access            /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000003   dbfseventsd 
00:58:59  lstat64           /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage         0.000019   fseventsd   
00:58:59  lstat64           /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-wal     0.000003   fseventsd   
00:58:59  lstat64           /Users/alistair/Library/Safari/LocalStorage/https_jet.com_0.localstorage-shm     0.000002   fseventsd
Related Question