feat: restore extended attributes during file extraction - #138
Merged
Conversation
qkaiser
self-requested a review
August 31, 2026 12:00
qkaiser
reviewed
Aug 31, 2026
qkaiser
force-pushed
the
feat/preserve-xattr
branch
from
September 1, 2026 07:18
997d511 to
f74c52c
Compare
Contributor
|
Initial approach was a bit naive in regards to Fixed with f74c52c |
elektrischermoench
approved these changes
Sep 1, 2026
ubireader_extract_files already parses each inode's xent (xattr entry) nodes while walking the filesystem, but silently discards them - no extended attribute is ever written to an extracted file, regardless of what the source UBIFS image actually contains (e.g. security.ima/ security.evm signatures, SMACK labels). Add a --preserve-xattr flag (mirroring the existing --keep-permissions one, also root-only) that resolves each xent to its target inode and writes it via os.setxattr(). Xattr values are stored inline in their own inode's data field rather than as separate UBIFS_DATA_KEY nodes - the same mechanism decrypt_symlink_target() already relies on for symlink targets - so extraction reuses that same access pattern rather than the regular-file data-node reader. The extraction root's timestamps, ownership, and mode are restored before its xattrs. security.evm is always written after all other xattrs.
qkaiser
force-pushed
the
feat/preserve-xattr
branch
from
September 1, 2026 11:36
ddf4a82 to
b8b8bad
Compare
qkaiser
enabled auto-merge
September 1, 2026 11:37
qkaiser
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ubireader_extract_files already parses each inode's xent (xattr entry) nodes while walking the filesystem, but silently discards them - no extended attribute is ever written to an extracted file, regardless of what the source UBIFS image actually contains (e.g. security.ima/ security.evm signatures, SMACK labels).
Add a --preserve-xattr flag (mirroring the existing --keep-permissions one, also root-only) that resolves each xent to its target inode and writes it via os.setxattr(). Xattr values are stored inline in their own inode's data field rather than as separate UBIFS_DATA_KEY nodes - the same mechanism decrypt_symlink_target() already relies on for symlink targets - so extraction reuses that same access pattern rather than the regular-file data-node reader.