Open a document: how it works, and where it can go wrong, 3: Launch

In the previous articles looking at how macOS opens a document from the Finder, I have shown how the document’s UTI is discovered, and how security checks are performed on the document before it is passed to the app to open. This final article looks at the choice of app in which to open the document, and other checks which take place.

Once macOS has the document UTI, LaunchServices then looks up the default editing app associated with that type. This may involve traversing the conformance list, starting with the most specific UTI, such as If there is an app specifically designated as the editor for that type, then that will be opened.

If not, LaunchServices looks at its parent, in that case public.plain-text, for a default editor, and so on up the tree until the most specific editor is identified.


Apps declare their ability to act as an editor of specific document types in Document Types, which give the UTI and optionally other details such as filename extensions which they support, and in what role. Those are in turn embedded in the app bundle in its Info.plist file. As that is included in the files used to determine the app’s code signature, trying to make any changes in that Property List will break its signature check and render the app unusable. Only the app’s developer can alter details of the document types which it supports.


The user can choose between different editor apps in the Finder. To open a specific document using an app other than the default for that UTI type, Control-Click and hold for the contextual menu, and choose the new editor from the second item in that menu.


To change this on a more permanent basis, open the Get Info dialog and change it in the Open with: section of that dialog. To propagate that to all other documents of the UTI type, click on the Change All… button.

Some documents contain additional information which can aid their access. For example, text files often have the extended attribute, which states the encoding method of the text within them. Such information within the document is not used here, either to help determine the UTI type of the document or the editor with which to open it. Any additional information is available to the app which is chosen to open the document, once it has been told to open the file.

This is particularly important for text editors: your default editor for public.plain-text may be TextEdit, which you may find doesn’t handle some text encodings such as windows-1252 as well as more specialist tools like BBEdit. If you experience problems in the choice of default, you need to change that default using the Finder’s Get Info dialog.

The most confusing issue about watching LaunchServices open the default editor app for a document and then that document itself, is that the unified log doesn’t mention LaunchServices itself, but the background service which handles this process, named sharedfilelistd, which may not be the service you were expecting to come across.

Instead of seeing log entries about how launchd launches the app, you may be confused with the following:
08:14:05.413193 CommCenter #I CSIAppInfo.ApplicationActivationObserver: handleLSNotitifcation_sync: Application launched: AppInfo[Preview,, true, 2892, 0]
08:14:05.414170 Finder SharedFileList
08:14:05.414345 sharedfilelistd[378] apply change Change: SFLChangeTypeInsert item named: [AB822C59-E524-4DFA-8728-FE24424B43AF] - URL:file:///Applications/ to list
08:14:05.414489 Dock SharedFileList
08:14:05.414608 sharedfilelistd[374] subscribed to list
08:14:05.414635 sharedfilelistd [] Reading list content from the store.
08:14:05.415720[374] item changes (
"Change: SFLChangeTypeRemove item named: [29B5BD10-DE90-41BB-B4D6-50C2812B6F27] - URL:file:///Applications/",
"Change: SFLChangeTypeInsert item named: [AB822C59-E524-4DFA-8728-FE24424B43AF] - URL:file:///Applications/"

and so on. Note the unusual typo in handleLSNotitifcation_sync, which makes this entry easy to spot in a text editor, but I think has been corrected in High Sierra.

The editor app then loads up its preferences from the CFPrefsID service, checks its iCloud connections through bird and CloudDocs, loads the Pasteboard (Clipboard), and finally reads the document which you double-clicked/tapped:
08:14:05.637600 Preview Foundation Read options: 0 -- URL: file:///Users/hoakley/Documents/0newDownloads/apfs/copyonwrite5.jpg -- purposeID: 70A53961-1148-418C-B0E9-D9D2AE8DB8AC

It has taken around 0.25 second, over 100 log entries, and three articles to go from the double-click to actually opening the document, but I finally got there.

Here’s a sleek visual summary for you to tear off and keep: