11

SELinux documentation for Debian says that user_xattr is not the same as extended attributes. So what is it?

1 Answer 1

13

Mounting a filesystem with user_xattr enables support for extended user attributes. These are a specific type of extended attributes; from attr(5):

Extended user attributes may be assigned to files and directories for storing arbitrary additional information such as the mime type, character set or encoding of a file. The access permissions for user attributes are defined by the file permission bits: read permission is required to retrieve the attribute value, and writer permission is required to change it.

Other types of extended attributes are security attributes (used e.g. for SELinux), system attributes (ACLs etc.), and trusted attributes (restricted to CAP_SYS_ADMIN).

There's a matching nouser_xattr to explicitly disable extended user attributes.

Most of the filesystems which support extended user attributes enable them by default nowadays, so user_xattr is no longer necessary; the exception is ReiserFS. ext2 and ext3 used to require support to be enabled with this option, but that is no longer true (see xattr(7) for details).

5
  • So it only enables the use of user.* attributes? Can't I use those without this mount option?
    – Melab
    Commented Jun 16, 2016 at 13:48
  • @Melab in the past yes, but nowadays it's enabled by default (except on ReiserFS). Commented Jun 16, 2016 at 13:58
  • Then why do I see it on my smartphone? Also, explain inline_xattr.
    – Melab
    Commented Jun 17, 2016 at 2:12
  • And why does it enabke just user.*? What is different about trusted.*, system.*, and security.*?
    – Melab
    Commented Jun 17, 2016 at 2:15
  • Your smartphone is presumably using F2FS, which reports user_xattr explicitly even when it's enabled by default. inline_xattr is F2FS-specific and indicates the ability to store extended attributes in an inode. user_xattr only controls user attributes because that's what it's designed for; the other types of extended attributes are always enabled by default on systems which support them. The difference is that any user can write user attributes, whereas other xattrs have stricter access controls (and so less risk associated with enabling them). Commented Jun 18, 2016 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .