Extended attributes belong to the inode and to a namespace

Tue, 14 Dec 2027 00:00:00 +0000

Extended attributes attach named byte values to filesystem objects outside the ordinary file-content stream. Applications can use the user namespace for small metadata, while other namespaces have kernel, security-module, or privileged semantics. Their usefulness depends on the filesystem, access rules, and transfer tools. A metadata tag is reliable only when the workflow preserves and interprets it according to an explicit contract.

When it breaks

An attribute value is not necessarily text. It can contain NUL bytes or arbitrary binary data, so treating it as a terminated string or assuming a particular encoding can corrupt the value. An empty attribute and a missing attribute are also different states. Returning an empty string for both can hide whether the metadata was deliberately set or lost during transfer.

Same-filesystem rename retains the object and its attributes, but copying content usually creates another inode. The copy tool decides which metadata it attempts to preserve. Equal file hashes therefore do not prove equal extended attributes. A pipeline can successfully deliver every content byte while omitting a classification, origin, or application version tag that downstream processing expects.

Namespace names do not create application authorization rules. Setting user.classification=private does not make a readable file confidential. User attributes follow applicable file-access permissions; security attributes have their own documented semantics and policy. Confusing an application label with enforced access control can expose content while the label appears reassuringly intact.

Check it quickly

Save this as xattrs.py and run python3 xattrs.py as root in a disposable Linux container whose temporary directory supports user extended attributes. The recorded run used Linux 6.12.76, Python 3.11.2, and an ext4 volume. Root prepares the fixture and starts one child under an unprivileged numeric identity; no account is created:

from pathlib import Path
from tempfile import TemporaryDirectory
import errno,os,shutil,subprocess,sys

def fails(code,operation):
 try:operation()
 except OSError as error:assert error.errno==code,error
 else:raise AssertionError('expected attribute error')
with TemporaryDirectory(prefix='xbcatm-xattr-') as directory:
 root=Path(directory);root.chmod(0o755);path=root/'data';path.write_bytes(b'public fixture');path.chmod(0o644)
 os.setxattr(path,'user.review',b'binary\0value\xff',os.XATTR_CREATE)
 assert os.getxattr(path,'user.review')==b'binary\0value\xff'
 fails(errno.EEXIST,lambda:os.setxattr(path,'user.review',b'other',os.XATTR_CREATE))
 fails(errno.ENODATA,lambda:os.setxattr(path,'user.missing',b'value',os.XATTR_REPLACE))
 os.setxattr(path,'user.empty',b'');assert os.getxattr(path,'user.empty')==b''
 os.removexattr(path,'user.empty');fails(errno.ENODATA,lambda:os.getxattr(path,'user.empty'))
 print('attribute values are bytes; empty differs from missing; CREATE and REPLACE enforce their preconditions')
 alias=root/'alias';os.link(path,alias)
 os.setxattr(alias,'user.review',b'shared',os.XATTR_REPLACE)
 assert os.getxattr(path,'user.review')==b'shared'
 moved=root/'moved';path.rename(moved);assert os.getxattr(moved,'user.review')==b'shared'
 plain=root/'plain';preserved=root/'preserved';shutil.copyfile(moved,plain);shutil.copy2(moved,preserved)
 fails(errno.ENODATA,lambda:os.getxattr(plain,'user.review'))
 assert os.getxattr(preserved,'user.review')==b'shared'
 assert plain.read_bytes()==preserved.read_bytes()==moved.read_bytes()
 print('hard links and same-filesystem rename retain inode attributes; copyfile omits them, copy2 preserves this supported user attribute')
 os.setxattr(moved,'user.classification',b'private')
 probe=r'''
from pathlib import Path
import errno,os,sys
path=Path(sys.argv[1]);assert path.read_bytes()==b'public fixture'
assert os.getxattr(path,'user.classification')==b'private'
try:os.setxattr(path,'user.classification',b'changed')
except OSError as error:assert error.errno==errno.EACCES
else:raise AssertionError('another identity changed a read-only user attribute')
'''
 result=subprocess.run([sys.executable,'-c',probe,str(moved)],user=61001,group=61001,extra_groups=[],capture_output=True,text=True,timeout=5)
 assert result.returncode==0,result.stderr
 fails(errno.E2BIG,lambda:os.setxattr(moved,'user.too_large',b'x'*65537))
 print('a user.classification label does not enforce confidentiality; file permissions block the other identity from changing it; oversized value returns E2BIG')

The fixture stores a value containing both NUL and a non-UTF-8 byte and retrieves the exact bytes. Creating the same key again with XATTR_CREATE fails with EEXIST, while replacing a missing key with XATTR_REPLACE fails with ENODATA. These flags express preconditions instead of silently turning every write into an unconditional update.

An explicitly empty value reads back as empty bytes. After removal, reading that key returns ENODATA. This provides a direct distinction between absence and an intentionally empty attribute. A caller using metadata to drive behavior needs to decide how each state affects the operation rather than collapsing both into one convenient default.

A hard link shares the same inode, so updating the attribute through that name changes the value seen through the original name. Renaming the original within the filesystem preserves the attribute. The experiment then copies the file twice: copyfile preserves the content but omits the user attribute, while copy2 preserves this supported attribute in the tested environment.

All three content streams compare equal despite the metadata difference. Python documents metadata copying as dependent on platform support and permissions, so this successful copy2 result is not a universal guarantee for every attribute namespace or destination. Verification should inspect the attributes actually needed after the specific transfer, not merely the copy command’s exit status.

The file remains mode 0644 when tagged private. Another ordinary identity reads both its content and the tag, proving that the label did not enforce confidentiality. That identity cannot change the attribute because it lacks the relevant write permission. Finally, a value larger than 65536 bytes is rejected with E2BIG, demonstrating a real size boundary.

Preserve meaning across the workflow

Choose application-specific key names to avoid collisions within the shared user namespace, and define the value encoding and version. Keep values small enough for the target filesystems; their practical limits can be tighter than the Linux interface maximum and can depend on other metadata already attached to the inode.

Test backup, archive, restore, and cross-filesystem copy paths using both content and attribute assertions. Some destinations do not support the required namespaces, and some tools preserve them only with explicit options. Decide whether loss should fail the workflow or be represented through a documented alternative, based on the actual metadata contract.

Updating file bytes and updating a separate attribute are not automatically one application transaction. A checksum tag can become stale after a later write, and a writer able to change both data and metadata is not an independent integrity authority. Validate the relationship when consuming it, and use a stronger storage or signing contract when that relationship must survive concurrent changes or untrusted writers.

Sources

xattr(7), attribute namespaces, permission rules, and storage limits, checked 2026-09-12.
setxattr(2), CREATE/REPLACE behavior and attribute error conditions, checked 2026-09-12.
getxattr(2), binary values and missing-attribute errors, checked 2026-09-12.
Python 3.11 shutil documentation, copyfile and best-effort metadata preservation by copy2, checked 2026-09-12.

Xattr · XB Field Notes

Extended attributes belong to the inode and to a namespace

When it breaks

Check it quickly

Preserve meaning across the workflow

Sources