Skip to main content

What is the user.security.m.metadata extended attribute?

Written by Salvador Aguilar

Short answer

If you've found an extended attribute named user.security.m.metadata on files in a Linux server running Monarx, it was set by the Monarx agent. It is expected, managed by our agent, and not a sign of compromise.

What is this extended attribute?

Linux extended attributes (xattrs) are small name–value pairs stored alongside a file's normal metadata. The Monarx agent sets and manages user.security.m.metadata as part of its normal operation.

The attribute has various safeguards built in to protect it from forgery or replay, so a copied or hand-crafted value cannot be used to trick the agent.

You can view it on a file with:

getfattr -n user.security.m.metadata /path/to/file

Can I remove it?

Yes. Monarx does not prohibit removing this attribute if your environment requires it.

To remove it from a file:

setfattr -x user.security.m.metadata /path/to/file

Can other applications change it?

Yes. Attributes in the user. namespace can be written by any user or process with write permission to the file, so tools other than Monarx can add, overwrite, or strip this attribute. Common examples:

  • xattr utilities: setfattr and attr set or remove attributes directly

  • Copy tools: cp -a or cp --preserve=xattr copies the source file's attributes onto the destination

  • Sync tools: rsync -X (--xattrs) carries attributes from source to destination

  • Archive tools: tar --xattrs saves attributes and restores them on extraction

  • Backup and restore software configured to preserve extended attributes

  • Text editors and build tools that save by replacing the file, which can drop attributes

This is for awareness only; no action is needed unless it causes an issue in your environment.

⚠️ Is it causing a problem in your environment?

If this attribute conflicts with your tooling, backups, or workflows, we'd like to hear about it. Email support@monarx.com and include:

  • Your Monarx enterprise name

  • A description of the issue and how the attribute affects your environment

  • Any relevant details, such as the tools involved, OS and filesystem, and example file paths

Our team will review your case and follow up.

Related Articles
Did this answer your question?