Extended attributes (name and value pairs such as security.selinux) are kept
apart from the inodes. An inode carries only an xattr index; the table keeps each
distinct set of attributes once, so many files with the same attributes share one index.
The table is absent (the superblock’s xattr table start is all ones, flag NO_XATTRS)
when no file has any. All numbers are in the image’s byte order.
Layout
The superblock points at the table’s header. In file order the table is: the key/value metadata blocks, the id metadata blocks, the header, then the pointers to the id blocks.
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 8 | uint64 | Key/value start | The file offset of the first key/value metadata block. A key/value reference is counted from here. |
8 | 4 | uint32 | Xattr ids | The number of entries in the id table below. |
12 | 4 | uint32 | Unused | Zero. |
16 | 8 × n | uint64[] | Pointers | The file offsets of the metadata blocks of the id table, n being the ids divided by 512, rounded up. |
Xattr id table
An inode’s xattr index selects one 16-byte entry (512 to a metadata block):
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 8 | uint64 | Xattr | A reference into the key/value blocks: the block (counted from the key/value start) times 65536 plus the offset. |
8 | 4 | uint32 | Count | The number of key/value pairs. |
12 | 4 | uint32 | Size | The size in bytes of this id’s key/value data. A reader does not need it: it walks the pairs by their count. |
Key/value pairs
Each pair, in the key/value table:
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 2 | uint16 | Type | Bits 0 to 7: the name prefix: 0 user., 1 trusted., 2 security.. Bit 8 (0x100): the value is stored out of line. |
2 | 2 | uint16 | Name size | The length of the name, which does not include the prefix. |
4 | size | bytes | Name | The name after the prefix, with no terminator. |
4 + size | 4 | uint32 | Value size | The size of the value; for an out-of-line value, 8. |
8 + size | value size | bytes | Value | The value’s bytes (any bytes, often text), or for an out-of-line value an 8-byte reference. |
An out-of-line value is a value that several attributes share: the pair holds a
reference (block times 65536 plus offset, counted from the key/value start) to a 4-byte size and the
value, stored once. The full attribute name is the prefix and the name, such as
user.comment.