Extended attributes, immutable attributes, and capabilities · Linux

Beyond standard permissions and ACLs, Linux supports two more metadata layers: extended attributes (xattrs) and filesystem attributes (chattr flags). Together with file capabilities, they let you lock down files in ways that survive chmod.

Extended attributes (xattrs)

xattrs are arbitrary name:value pairs attached to a file. The namespace determines who can set them:

Namespace	Prefix	Who can read	Who can set
User	`user.`	The owner	The owner
Trusted	`trusted.`	Root only	Root only
System	`system.`	Root only	The kernel
Security	`security.`	The owner and root	Root only

Read-only / Safegetfattr -d— getfattr -d dumps all user.* xattrs. By default, security.* and system.* namespaces are not shown; pass -m to include them. /etc/passwd in this example has no extended attributes, which is normal.

$ getfattr -d -m ".*" /etc/passwd

# file: etc/passwd

Illustrative output

Configuration changesetfattr— setfattr -n NAME -v VALUE sets a user.* xattr. getfattr -n NAME retrieves it. Useful for marking files for configuration management, backup policies, or audit tracking.

$ setfattr -n user.origin -v production-import /etc/passwd; getfattr -n user.origin /etc/passwd

# file: etc/passwd
user.origin=production-import

Illustrative output

Common xattrs in production:

xattr	Purpose
`security.selinux`	SELinux context (when SELinux is enabled)
`security.capability`	File capabilities (covered later)
`user.origin`	Often used by configuration management to mark managed files
`trusted.*`	Used by some security tools (e.g., AIDE) for integrity hashes
`system.posix_acl_access`	POSIX ACL (handled via getfacl/setfacl, not directly)

Filesystem attributes (chattr)

chattr sets flags that live at the filesystem level and are enforced by the kernel. Two flags matter most in production:

Flag	Effect
`+i` (immutable)	The file cannot be modified, deleted, renamed, or have its metadata changed (even by root).
`+a` (append-only)	The file can only be opened for appending; existing content cannot be modified.
`+u` (undeletable)	When deleted, contents are saved for later undelete (rarely used; depends on filesystem).
`+c` (compressed)	Mark for transparent compression on filesystems that support it.
`+s` (secure deletion)	Blocks are zeroed on delete.

Configuration changeimmutable file— chattr +i sets the immutable flag. lsattr shows it in the flags column (i). Any modification attempt — including by root — fails with EPERM.

$ chattr +i /etc/passwd; lsattr /etc/passwd

----i---------e------- /etc/passwd

Illustrative output

File capabilities

Capabilities are the kernel’s replacement for setuid. A binary with CAP_NET_BIND_SERVICE can bind to port 80 without being root. A binary with CAP_DAC_OVERRIDE can read any file.

There are two ways to grant capabilities:

Process capabilities — granted to a running process.
File capabilities — attached to a binary; the process receives them when it execs the binary.

The file capabilities are stored in security.capability xattr:

Read-only / Safegetcap— getcap reads security.capability xattr. ping needs cap_net_raw to send ICMP packets; mount.nfs needs broad capabilities to perform the mount operation. These binaries do not need to be setuid root.

$ getcap /usr/bin/ping /usr/sbin/mount.nfs

/usr/bin/ping = cap_net_raw+ep
/usr/sbin/mount.nfs = cap_dac_override,cap_sys_admin+ep

Illustrative output

Configuration changesetcap— setcap grants cap_net_bind_service, the capability to bind to a privileged port (below 1024). The +ep means effective + permitted. With this, the application can bind to port 443 without being root and without setuid.

$ setcap cap_net_bind_service+ep /opt/myapp/bin/web; getcap /opt/myapp/bin/web

/opt/myapp/bin/web = cap_net_bind_service+ep

Illustrative output

Flag	Meaning
`+ep`	Effective and Permitted — both the active capability and the inheritable set
`+p`	Permitted only — the capability is added to the permitted set but not raised into effective automatically
`+ei`	Effective and Inheritable — the capability propagates to child processes

Putting it together

For a hardened production binary:

# Application needs to bind to port 443 without being root
chown appuser:appgroup /opt/myapp/bin/web
chmod 0750 /opt/myapp/bin/web
setcap cap_net_bind_service+ep /opt/myapp/bin/web

The application runs as appuser, has only its group able to read or execute it, and can bind to port 443 because it holds the relevant capability. No setuid, no full root, no broader attack surface.

For a config file that should not change:

chattr +i /etc/ssh/sshd_config
chattr +i /etc/sudoers
chattr +i /etc/pam.d/su

Any modification attempt, including by root, fails. The file is locked until chattr -i removes the flag.

Extended attributes (xattrs)

Filesystem attributes (chattr)

File capabilities

Putting it together

Knowledge check