<!DOCTYPE html>
<html lang="en" data-content_root="../../">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>4.4. Extended Attributes — The Linux Kernel documentation</title>
<link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="../../_static/alabaster.css?v=3918102e" />
<script src="../../_static/documentation_options.js?v=5929fcd5"></script>
<script src="../../_static/doctools.js?v=9bcbadda"></script>
<script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="../../genindex.html" />
<link rel="search" title="Search" href="../../search.html" />
<link rel="next" title="Flash-Friendly File System (F2FS)" href="../f2fs.html" />
<link rel="prev" title="4.3. Directory Entries" href="directory.html" />
<link rel="stylesheet" href="../../_static/custom.css" type="text/css" />
</head><body>
<div class="document">
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<p class="logo"><a href="../../index.html">
<img class="logo" src="../../_static/logo.svg" alt="Logo of The Linux Kernel"/>
</a></p>
<h1 class="logo"><a href="../../index.html">The Linux Kernel</a></h1>
<p class="blurb">6.18.50</p>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../../search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
<p>
<h3 class="kernel-toc-contents">Contents</h3>
<input type="checkbox" class="kernel-toc-toggle" id = "kernel-toc-toggle" checked>
<label class="kernel-toc-title" for="kernel-toc-toggle"></label>
<div class="kerneltoc" id="kerneltoc">
<ul>
<li class="toctree-l1"><a class="reference internal" href="../../process/development-process.html">Development process</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../process/submitting-patches.html">Submitting patches</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../process/code-of-conduct.html">Code of conduct</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../maintainer/index.html">Maintainer handbook</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../process/index.html">All development-process docs</a></li>
</ul>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../core-api/index.html">Core API</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../driver-api/index.html">Driver APIs</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../../subsystem-apis.html">Subsystems</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../../subsystem-apis.html#core-subsystems">Core subsystems</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../subsystem-apis.html#human-interfaces">Human interfaces</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../subsystem-apis.html#networking-interfaces">Networking interfaces</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="../../subsystem-apis.html#storage-interfaces">Storage interfaces</a><ul class="current">
<li class="toctree-l3 current"><a class="reference internal" href="../index.html">Filesystems in the Linux kernel</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../block/index.html">Block</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../cdrom/index.html">CD-ROM</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../scsi/index.html">SCSI Subsystem</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../target/index.html">TCM Virtual Device</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../nvme/index.html">NVMe Subsystem</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../../subsystem-apis.html#other-subsystems">Other subsystems</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../locking/index.html">Locking</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../../process/license-rules.html">Licensing rules</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../doc-guide/index.html">Writing documentation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../dev-tools/index.html">Development tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../dev-tools/testing-overview.html">Testing guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../kernel-hacking/index.html">Hacking guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../trace/index.html">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../fault-injection/index.html">Fault injection</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../livepatch/index.html">Livepatching</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../rust/index.html">Rust</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../../admin-guide/index.html">Administration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../kbuild/index.html">Build system</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../admin-guide/reporting-issues.html">Reporting issues</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../tools/index.html">Userspace tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../userspace-api/index.html">Userspace API</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../../firmware-guide/index.html">Firmware</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../devicetree/index.html">Firmware and Devicetree</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../../arch/index.html">CPU architectures</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../../staging/index.html">Unsorted documentation</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../../translations/index.html">Translations</a></li>
</ul>
</div>
<script type="text/javascript"> <!--
var sbar = document.getElementsByClassName("sphinxsidebar")[0];
let currents = document.getElementsByClassName("current")
if (currents.length) {
sbar.scrollTop = currents[currents.length - 1].offsetTop;
}
--> </script>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="../../_sources/filesystems/ext4/attributes.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
</div>
</div>
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="extended-attributes">
<h1><span class="section-number">4.4. </span>Extended Attributes<a class="headerlink" href="#extended-attributes" title="Link to this heading">¶</a></h1>
<p>Extended attributes (xattrs) are typically stored in a separate data
block on the disk and referenced from inodes via <code class="docutils literal notranslate"><span class="pre">inode.i_file_acl*</span></code>.
The first use of extended attributes seems to have been for storing file
ACLs and other security data (selinux). With the <code class="docutils literal notranslate"><span class="pre">user_xattr</span></code> mount
option it is possible for users to store extended attributes so long as
all attribute names begin with “user”; this restriction seems to have
disappeared as of Linux 3.0.</p>
<p>There are two places where extended attributes can be found. The first
place is between the end of each inode entry and the beginning of the
next inode entry. For example, if inode.i_extra_isize = 28 and
sb.inode_size = 256, then there are 256 - (128 + 28) = 100 bytes
available for in-inode extended attribute storage. The second place
where extended attributes can be found is in the block pointed to by
<code class="docutils literal notranslate"><span class="pre">inode.i_file_acl</span></code>. As of Linux 3.11, it is not possible for this
block to contain a pointer to a second extended attribute block (or even
the remaining blocks of a cluster). In theory it is possible for each
attribute’s value to be stored in a separate data block, though as of
Linux 3.11 the code does not permit this.</p>
<p>Keys are generally assumed to be ASCIIZ strings, whereas values can be
strings or binary data.</p>
<p>Extended attributes, when stored after the inode, have a header
<code class="docutils literal notranslate"><span class="pre">ext4_xattr_ibody_header</span></code> that is 4 bytes long:</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 10.0%" />
<col style="width: 10.0%" />
<col style="width: 30.0%" />
<col style="width: 50.0%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Offset</p></th>
<th class="head"><p>Type</p></th>
<th class="head"><p>Name</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>0x0</p></td>
<td><p>__le32</p></td>
<td><p>h_magic</p></td>
<td><p>Magic number for identification, 0xEA020000. This value is set by the
Linux driver, though e2fsprogs doesn’t seem to check it(?)</p></td>
</tr>
</tbody>
</table>
<p>The beginning of an extended attribute block is in
<code class="docutils literal notranslate"><span class="pre">struct</span> <span class="pre">ext4_xattr_header</span></code>, which is 32 bytes long:</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 10.0%" />
<col style="width: 10.0%" />
<col style="width: 30.0%" />
<col style="width: 50.0%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Offset</p></th>
<th class="head"><p>Type</p></th>
<th class="head"><p>Name</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>0x0</p></td>
<td><p>__le32</p></td>
<td><p>h_magic</p></td>
<td><p>Magic number for identification, 0xEA020000.</p></td>
</tr>
<tr class="row-odd"><td><p>0x4</p></td>
<td><p>__le32</p></td>
<td><p>h_refcount</p></td>
<td><p>Reference count.</p></td>
</tr>
<tr class="row-even"><td><p>0x8</p></td>
<td><p>__le32</p></td>
<td><p>h_blocks</p></td>
<td><p>Number of disk blocks used.</p></td>
</tr>
<tr class="row-odd"><td><p>0xC</p></td>
<td><p>__le32</p></td>
<td><p>h_hash</p></td>
<td><p>Hash value of all attributes.</p></td>
</tr>
<tr class="row-even"><td><p>0x10</p></td>
<td><p>__le32</p></td>
<td><p>h_checksum</p></td>
<td><p>Checksum of the extended attribute block.</p></td>
</tr>
<tr class="row-odd"><td><p>0x14</p></td>
<td><p>__u32</p></td>
<td><p>h_reserved[3]</p></td>
<td><p>Zero.</p></td>
</tr>
</tbody>
</table>
<p>The checksum is calculated against the FS UUID, the 64-bit block number
of the extended attribute block, and the entire block (header +
entries).</p>
<p>Following the <code class="docutils literal notranslate"><span class="pre">struct</span> <span class="pre">ext4_xattr_header</span></code> or
<code class="docutils literal notranslate"><span class="pre">struct</span> <span class="pre">ext4_xattr_ibody_header</span></code> is an array of
<code class="docutils literal notranslate"><span class="pre">struct</span> <span class="pre">ext4_xattr_entry</span></code>; each of these entries is at least 16 bytes
long. When stored in an external block, the <code class="docutils literal notranslate"><span class="pre">struct</span> <span class="pre">ext4_xattr_entry</span></code>
entries must be stored in sorted order. The sort order is
<code class="docutils literal notranslate"><span class="pre">e_name_index</span></code>, then <code class="docutils literal notranslate"><span class="pre">e_name_len</span></code>, and finally <code class="docutils literal notranslate"><span class="pre">e_name</span></code>.
Attributes stored inside an inode do not need be stored in sorted order.</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 10.0%" />
<col style="width: 10.0%" />
<col style="width: 30.0%" />
<col style="width: 50.0%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Offset</p></th>
<th class="head"><p>Type</p></th>
<th class="head"><p>Name</p></th>
<th class="head"><p>Description</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>0x0</p></td>
<td><p>__u8</p></td>
<td><p>e_name_len</p></td>
<td><p>Length of name.</p></td>
</tr>
<tr class="row-odd"><td><p>0x1</p></td>
<td><p>__u8</p></td>
<td><p>e_name_index</p></td>
<td><p>Attribute name index. There is a discussion of this below.</p></td>
</tr>
<tr class="row-even"><td><p>0x2</p></td>
<td><p>__le16</p></td>
<td><p>e_value_offs</p></td>
<td><p>Location of this attribute’s value on the disk block where it is stored.
Multiple attributes can share the same value. For an inode attribute
this value is relative to the start of the first entry; for a block this
value is relative to the start of the block (i.e. the header).</p></td>
</tr>
<tr class="row-odd"><td><p>0x4</p></td>
<td><p>__le32</p></td>
<td><p>e_value_inum</p></td>
<td><p>The inode where the value is stored. Zero indicates the value is in the
same block as this entry. This field is only used if the
INCOMPAT_EA_INODE feature is enabled.</p></td>
</tr>
<tr class="row-even"><td><p>0x8</p></td>
<td><p>__le32</p></td>
<td><p>e_value_size</p></td>
<td><p>Length of attribute value.</p></td>
</tr>
<tr class="row-odd"><td><p>0xC</p></td>
<td><p>__le32</p></td>
<td><p>e_hash</p></td>
<td><p>Hash value of attribute name and attribute value. The kernel doesn’t
update the hash for in-inode attributes, so for that case this value
must be zero, because e2fsck validates any non-zero hash regardless of
where the xattr lives.</p></td>
</tr>
<tr class="row-even"><td><p>0x10</p></td>
<td><p>char</p></td>
<td><p>e_name[e_name_len]</p></td>
<td><p>Attribute name. Does not include trailing NULL.</p></td>
</tr>
</tbody>
</table>
<p>Attribute values can follow the end of the entry table. There appears to
be a requirement that they be aligned to 4-byte boundaries. The values
are stored starting at the end of the block and grow towards the
xattr_header/xattr_entry table. When the two collide, the overflow is
put into a separate disk block. If the disk block fills up, the
filesystem returns -ENOSPC.</p>
<p>The first four fields of the <code class="docutils literal notranslate"><span class="pre">ext4_xattr_entry</span></code> are set to zero to
mark the end of the key list.</p>
<section id="attribute-name-indices">
<h2><span class="section-number">4.4.1. </span>Attribute Name Indices<a class="headerlink" href="#attribute-name-indices" title="Link to this heading">¶</a></h2>
<p>Logically speaking, extended attributes are a series of key=value pairs.
The keys are assumed to be NULL-terminated strings. To reduce the amount
of on-disk space that the keys consume, the beginning of the key string
is matched against the attribute name index. If a match is found, the
attribute name index field is set, and matching string is removed from
the key name. Here is a map of name index values to key prefixes:</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 20.0%" />
<col style="width: 80.0%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Name Index</p></th>
<th class="head"><p>Key Prefix</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>0</p></td>
<td><p>(no prefix)</p></td>
</tr>
<tr class="row-odd"><td><p>1</p></td>
<td><p>“user.”</p></td>
</tr>
<tr class="row-even"><td><p>2</p></td>
<td><p>“system.posix_acl_access”</p></td>
</tr>
<tr class="row-odd"><td><p>3</p></td>
<td><p>“system.posix_acl_default”</p></td>
</tr>
<tr class="row-even"><td><p>4</p></td>
<td><p>“trusted.”</p></td>
</tr>
<tr class="row-odd"><td><p>6</p></td>
<td><p>“security.”</p></td>
</tr>
<tr class="row-even"><td><p>7</p></td>
<td><p>“system.” (inline_data only?)</p></td>
</tr>
<tr class="row-odd"><td><p>8</p></td>
<td><p>“system.richacl” (SuSE kernels only?)</p></td>
</tr>
</tbody>
</table>
<p>For example, if the attribute key is “user.fubar”, the attribute name
index is set to 1 and the “fubar” name is recorded on disk.</p>
</section>
<section id="posix-acls">
<h2><span class="section-number">4.4.2. </span>POSIX ACLs<a class="headerlink" href="#posix-acls" title="Link to this heading">¶</a></h2>
<p>POSIX ACLs are stored in a reduced version of the Linux kernel (and
libacl’s) internal ACL format. The key difference is that the version
number is different (1) and the <code class="docutils literal notranslate"><span class="pre">e_id</span></code> field is only stored for named
user and group ACLs.</p>
</section>
</section>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
©The kernel development community.
|
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 8.1.3</a>
& <a href="https://alabaster.readthedocs.io">Alabaster 0.7.16</a>
|
<a href="../../_sources/filesystems/ext4/attributes.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>