Re: [PATCH 00/15] smb: add native security and trusted xattrs

Hi Ralph,

For a handle opened with an SMB3 POSIX create context, the mapping in
this series is:

     Client-visible xattr        Protocol EA name        Server xattr
-----------------------------------------------------------------------
     user.foo                    foo                     user.foo
     security.capability         security.capability  security.capability
     security.xfstests           security.xfstests  security.xfstests
     trusted.foo                 trusted.foo  trusted.foo

Apart from the special native xattr mappings described above, all other
xattrs in the user namespace continue to use the existing SMB EA mapping:
the client removes "user." before sending the name,
and ksmbd adds it back when accessing the server filesystem.

This results in name collisions for the following attributes:

     Client user xattr           Protocol EA name
     ------------------------------------------------
     user.security.capability    security.capability
     user.security.xfstests      security.xfstests
     user.trusted.foo            trusted.foo

In POSIX mode, these protocol names are reserved for the corresponding
native xattrs. The client therefore rejects the colliding user.* names,
and ksmbd does not expose the corresponding user.* xattrs when EAs are
listed through a POSIX handle.

For example, EA enumeration through a POSIX handle produces the
following results:

     Server xattr                Protocol EA name Client-visible xattr
-----------------------------------------------------------------------
     user.foo                    foo                     user.foo
     security.capability         security.capability  security.capability
     trusted.foo                 trusted.foo  trusted.foo
     user.security.capability    hidden                  not returned

Without a POSIX create context, the existing behavior remains
unchanged: protocol EA names are mapped into the server's user.*
namespace, and native security.* and trusted.* xattrs are not exposed.

Thanks,
Ze

在 2026/7/24 19:49, Ralph Boehme 写道:
> On 7/24/26 12:39 PM, Ze Tan wrote:
>> Native xattrs are returned without a prefix when EAs are listed. Their
>> corresponding user.* backing xattrs are hidden in native mode.
> sorry, but I don't really understand how this is supposed to work... :)
>
> Maybe you can provide a simple table that shows the representation on 
> server, client and protocol for the relevant namespaces?
>
> From your commit message alone, I couldn't tell how the user namespace 
> is intended to be handled.
>
> Thanks!
>
>