{"record":{"id":"7c938a4c88863b00","repo":"containerd/containerd","slug":"failed-to-set-xattr-q-on-s-w","errorCode":null,"errorMessage":"failed to set xattr %q on %s: %w","messagePattern":"failed to set xattr %q on (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/archive/tar_unix.go","lineNumber":209,"sourceCode":"\t\tif err == unix.ENOTSUP || err == sysx.ENODATA {\n\t\t\treturn nil\n\t\t}\n\t\treturn fmt.Errorf(\"failed to list xattrs on %s: %w\", src, err)\n\t}\n\tfor _, xattr := range xattrKeys {\n\t\t// Do not copy up trusted attributes\n\t\tif strings.HasPrefix(xattr, \"trusted.\") {\n\t\t\tcontinue\n\t\t}\n\t\tdata, err := sysx.LGetxattr(src, xattr)\n\t\tif err != nil {\n\t\t\tif err == unix.ENOTSUP || err == sysx.ENODATA {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"failed to get xattr %q on %s: %w\", xattr, src, err)\n\t\t}\n\t\tif err := lsetxattrCreate(dst, xattr, data); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set xattr %q on %s: %w\", xattr, dst, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":191,"sourceCodeEnd":215,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/pkg/archive/tar_unix.go#L191-L215","documentation":"copyUpXAttrs writes each read attribute onto the destination via lsetxattrCreate and wraps failures as 'failed to set xattr'. The value was read fine from the source, but the destination filesystem or privilege level rejected the write.","triggerScenarios":"lsetxattrCreate(dst, key, data) failing with ENOTSUP (destination FS lacks xattrs for that namespace), EPERM (unprivileged write to security.*/system.*), ENOSPC (xattr size/EA block limits exceeded), or EDQUOT.","commonSituations":"Copying layers onto tmpfs/vfat/9p mounts without user.* xattr support; copying security.selinux into a container without privileges; exceeding destination inode EA space when many/large xattrs are present.","solutions":["Check the wrapped errno: ENOTSUP => move destination to xattr-capable FS; EPERM => run privileged or drop protected namespaces.","Filter to 'user.' namespace keys when destination privileges are limited.","If ENOSPC, raise the filesystem EA limits or drop large/unused attributes (e.g. large security.ima entries).","Match SELinux/AppArmor context handling between source and destination hosts."],"exampleFix":"// before\nfor _, x := range keys { setXattr(dst, x, data) } // fails on security.selinux as non-root\n// after\nfor _, x := range keys {\n    if !strings.HasPrefix(x, \"user.\") { continue }\n    setXattr(dst, x, data)\n}","handlingStrategy":"validation","validationCode":"// Go: verify destination accepts xattrs before copy\nif err := sysx.LSetxattr(dst, \"user.probe\", []byte{1}, 0); err != nil {\n    if errors.Is(err, unix.ENOTSUP) {\n        return fmt.Errorf(\"destination %s does not support xattrs\", dst)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := lsetxattrCreate(dst, key, data); err != nil {\n    if errors.Is(err, unix.EPERM) {\n        log.Warn(\"no privilege for xattr namespace\", \"key\", key)\n        return nil\n    }\n    return fmt.Errorf(\"failed to set xattr %q: %w\", key, err)\n}","preventionTips":["Select xattr-capable destination filesystems.","Drop protected namespaces when running unprivileged.","Watch for ENOSPC on inode EA space with many/large xattrs.","Align SELinux policies between source and destination hosts."],"tags":["xattr","linux","filesystem","copy-up"],"backgroundTag":"xattr-set-failed","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}