Planning for extended attributes

Extended file attributes are key-value pairs that can be set programmatically by the file system, by other middleware such as the Data Management API, by the operating system, or by users. The name of an extended attribute consists of a namespace name followed by a dot followed by an attribute name, as in the following extended attribute names:

• gpfs.Encryption
• user.swift.metadata
• system.posix_acl_access

The public namespaces are system, security, trusted, and user. IBM Spectrum Scale has a few private namespaces, which include gpfs and dmapi.

You can access extended attributes in the public namespaces through operating system commands and functions. Linux® has commands such as setfattr and getfattr and functions such as setxattr() and getxattr() for accessing extended attributes.

• In Linux, the following facts are relevant:
  • You must have root-level access to work with extended attributes in the system, security, and trusted namespaces.
  • To set an extended attribute for a file or file object (directory, block device, pipe, or named socket) you must have write access to the entity.
  • The cp --preserve=xattr Linux command copies either the POSIX or the NFSv4 ACL extended attributes when an IBM Spectrum Scale file is copied. Also some Linux system calls are extended to handle attributes for POSIX and NFSV4 ACLs when the system calls are applied to files in IBM Spectrum Scale file systems. For more information, see Managing GPFS access control lists.
• In Windows, the following facts are relevant:
  • You must log on as an administrator to work with extended attributes in the system, security, and trusted namespaces.
  • Windows has file permissions for reading and writing extended attributes that are separate from its file permissions for reading or writing file data.
• In AIX®, the following facts are relevant:
  • IBM Spectrum Scale does not support AIX commands or functions that access extended attributes.

The native operating system commands and functions that are referred to in the preceding paragraph cannot access the private namespaces of IBM Spectrum Scale. You can access the extended attributes in the IBM Spectrum Scale private namespaces only through IBM Spectrum Scale resources, which are described in the following list. These resources can also access the extended attributes in the public namespaces. IBM Spectrum Scale supports these resources on all platforms, Linux, Windows, and AIX:

• The rules for automating file management include a set of functions for accessing, setting, and evaluating extended attributes. For more information, see Extended attribute functions.

• The mmchattr and mmlsattr commands provide parameters to create, set, get, or delete extended attributes. For more information, see mmchattr command and mmlsattr command.

  Note: The mmchattr command does not set some DMAPI extended attributes because of their side effects. However, you can set these extended attributes through DMAPI. For more information, see IBM Spectrum Scale Data Management API for GPFS information.
• The GPFS programming interfaces include a set of subroutines for getting and setting extended attributes. For more information, see GPFS programming interfaces.

The following features in IBM Spectrum Scale also handle extended attributes:

• Limitations:
  • Extended attributes are not encrypted when a file is encrypted.
  • Extended attributes cannot be added, deleted, or modified in an immutable or an appendOnly file. This restriction does not apply to extended attributes in the dmapi or gpfs namespaces.
• Size:
  • To determine the maximum allowed size of extended attributes, see Q6.11 in IBM Spectrum Scale FAQ in IBM® Documentation.
  • Fast extended attributes are stored first in the inode of a file, then, if more space is needed, in a maximum of one overflow block. The overflow block is the same size as the current metadata block size. The maximum space in the overflow block for storing extended attributes is the minimum of 64 KB or the metadata block size.
• Administration commands:
  • The mmafmconfig command has parameters that enable or disable extended attributes or sparse file support in the AFM cache.
  • The mmclone command does not copy extended attributes.
  • See the administration commands in the item "Back up and restore" following.
• Encryption:
  • In encryption, file extension keys (FEKs) are stored in the gpfs.Encryption extended attribute. It is a good idea to create a file system with an inode size of 4 K or larger to accommodate FEKs that are encrypted several times. If you encounter an error message that says that the extended attributes are too large, you must either change the encryption policy so that the file key is wrapped fewer times, reduce the number of keys that are used to wrap a file key, or create a file system that has a larger inode size. For more information, see the following links:
    • Encryption policies
    • Preparation for encryption
    • Error message 6027-3470 [E]
• Back up and restore:
  • Scale Out Backup and Restore (SOBAR) preserves and restores extended attributes. For more information, see Scale Out Backup and Restore (SOBAR).
  • The mmbackup and mmrestorefs commands preserve extended attributes. The mmrestorefs command has options to restore encryption attributes and to not restore external attributes. The IBM Spectrum Protect product has a setting in the dsm.sys configuration file that omits backing up a file if only an extended attribute is changed (SKIPACLUPDATECHECK). For more information, see Options in the IBM Spectrum Protect configuration file dsm.opt.
  • The mmrestorefs command has options to restore encryption attributes and to not restore external attributes.
• Disaster recovery
  • In outband disaster recovery, if you are transferring files that contain extended attributes, such as object data, you must use a method that transfers extended attributes, such IBM Spectrum Protect, cross-cluster mount, or AFM. For more information, see Creating the outband disaster recovery setup.
• Objects
  • In unified file and object access, the identity management modes local_mode and unified_mode have settings for retaining extended attributes. You can set values in the object-server-sof.conf configuration file to copy extended attributes, Windows attributes, and ACLs from an existing object. For more information, see the following links:
    • Identity management modes for unified file and object access
    • Configuring authentication and setting identity management modes for unified file and object access
• NFS v4
  • NFS v4 uses extended attributes to store some of its file attributes. For more information, see Linux ACLs and extended attributes.

If you are upgrading from IBM Spectrum Scale v3.3 to v3.4 or later, you must explicitly enable fast extended attributes in file systems that were created earlier than v3.4. After you upgrade IBM Spectrum Scale to the new level, enter the following command to enable extended attributes:

mmmigratefs <Device> --fastea

where <Device> is the device ID of the file system. To verify that extended attributes are enabled, issue the following command:

mmlsfs <Device> --fastea

For more information, see Completing the upgrade to a new level of IBM Spectrum Scale.