EAs are attached to a file’s i-node, not to the file’s data blocks.

EA support must come from both the kernel configuration and the underlying file system.

The user namespace is the one you will use most in application programming.

• Any unprivileged process can read/write user EAs, subject to file permissions.
• To read a user EA — you need read permission on the file.
• To write/modify a user EA — you need write permission on the file.
• On ext2/ext3/ext4 and Reiserfs, the filesystem must be mounted with user_xattr.
• EA names in the user namespace can be any arbitrary string.

# Mount ext4 filesystem with user_xattr support
mount -o user_xattr /dev/sdb1 /mnt/data

# Or add to /etc/fstab permanently:
# /dev/sdb1  /mnt/data  ext4  defaults,user_xattr  0 2

The trusted namespace works like user but requires elevated privileges.

• Process must have CAP_SYS_ADMIN capability (i.e., run as root or have the cap).
• Unprivileged processes cannot read or write trusted EAs.
• Used by system-level tools like overlayfs, backup daemons, and container runtimes.

/* Only root can do this */
#include <sys/xattr.h>

int main() {
    const char *val = "backup-server-1";
    /* This will fail with EPERM if not root */
    if (setxattr("/var/data/file.db", "trusted.backup_origin",
                 val, strlen(val), 0) == -1) {
        perror("setxattr trusted");
        return 1;
    }
    return 0;
}

The system namespace is exclusively for the kernel. You cannot create arbitrary system EAs from userspace. The kernel uses this namespace to attach objects to files — currently Access Control Lists (ACLs).

• Only names the kernel explicitly permits are accepted.
• Example: system.posix_acl_access and system.posix_acl_default.
• Managed indirectly through ACL commands like setfacl / getfacl.

# View system (ACL) EAs indirectly
getfacl /var/www/html/index.html

# View the raw system EA name
getfattr -m system -d /var/www/html/index.html

The security namespace is used by kernel security modules (LSMs) such as SELinux and AppArmor.

• Stores security labels that control mandatory access control (MAC).
• Also stores file capabilities (what a binary is allowed to do when executed).
• Originally created for SELinux (http://www.nsa.gov/research/selinux/).

# View SELinux security context of a file
ls -Z /etc/passwd
# Output: system_u:object_r:passwd_file_t:s0 /etc/passwd

# View the raw security EA
getfattr -n security.selinux /etc/passwd

# Create a file to test
touch myfile.txt

# Set a user EA: -n = name, -v = value
setfattr -n user.author -v "Ravi Kumar" myfile.txt

# Set another EA
setfattr -n user.version -v "1.0" myfile.txt

# Set an EA with an empty string value (valid, not undefined)
setfattr -n user.notes myfile.txt

# Overwrite an existing EA value
setfattr -n user.version -v "2.0" myfile.txt

# Remove an EA: -x = remove
setfattr -x user.notes myfile.txt

# Read a specific EA by name
getfattr -n user.author myfile.txt
# Output:
# file: myfile.txt
# user.author="Ravi Kumar"

# Dump ALL user EAs (default: only user namespace shown)
getfattr -d myfile.txt
# Output:
# file: myfile.txt
# user.author="Ravi Kumar"
# user.version="2.0"

# List ALL EAs from ALL namespaces (use "-m -" pattern)
getfattr -m - -d myfile.txt

# List only security EAs
getfattr -m "^security\." -d myfile.txt

# List EAs matching a pattern (e.g. names starting with "user.v")
getfattr -m "^user\.v" -d myfile.txt

This example walks through the full lifecycle of an extended attribute:

## STEP 1: Create a test file
$ touch testfile.txt

## STEP 2: Set two user EAs
$ setfattr -n user.quote1 -v "The past is not dead." testfile.txt
$ setfattr -n user.quote2 -v "In fact, it's not even past." testfile.txt

## STEP 3: Read one specific EA
$ getfattr -n user.quote1 testfile.txt
# file: testfile.txt
user.quote1="The past is not dead."

## STEP 4: Dump all user EAs
$ getfattr -d testfile.txt
# file: testfile.txt
user.quote1="The past is not dead."
user.quote2="In fact, it's not even past."

## STEP 5: Change quote1 to empty string
$ setfattr -n user.quote1 testfile.txt   # no -v = empty value

## STEP 6: Dump again — note quote1 shows no value
$ getfattr -d testfile.txt
# file: testfile.txt
user.quote1                              # empty string
user.quote2="In fact, it's not even past."

## STEP 7: Remove quote2 entirely
$ setfattr -x user.quote2 testfile.txt

## STEP 8: Dump again — only quote1 remains
$ getfattr -d testfile.txt
# file: testfile.txt
user.quote1                              # empty string, still exists