diff --git a/pkg/meta/utils_darwin.go b/pkg/meta/utils_darwin.go
index 30b1ccb89fd4..fea6806da62c 100644
--- a/pkg/meta/utils_darwin.go
+++ b/pkg/meta/utils_darwin.go
@@ -17,4 +17,5 @@ const (
 	XattrCreateOrReplace = 0
 	XattrCreate          = sys.XATTR_CREATE
 	XattrReplace         = sys.XATTR_REPLACE
+	XattrNoSecurity      = sys.XATTR_NOSECURITY
 )
diff --git a/pkg/meta/utils_linux.go b/pkg/meta/utils_linux.go
index 39d26708c246..bc4ca9d460b8 100644
--- a/pkg/meta/utils_linux.go
+++ b/pkg/meta/utils_linux.go
@@ -17,4 +17,5 @@ const (
 	XattrCreateOrReplace = 0
 	XattrCreate          = sys.XATTR_CREATE
 	XattrReplace         = sys.XATTR_REPLACE
+	XattrNoSecurity      = 8
 )
diff --git a/pkg/meta/utils_windows.go b/pkg/meta/utils_windows.go
index 5157b99e33d8..be0fade5711a 100644
--- a/pkg/meta/utils_windows.go
+++ b/pkg/meta/utils_windows.go
@@ -30,4 +30,5 @@ const (
 	XattrCreateOrReplace = 0
 	XattrCreate          = 1
 	XattrReplace         = 2
+	XattrNoSecurity      = 8
 )
diff --git a/pkg/vfs/vfs.go b/pkg/vfs/vfs.go
index 45db3fe2980f..8a7937129f71 100644
--- a/pkg/vfs/vfs.go
+++ b/pkg/vfs/vfs.go
@@ -1072,6 +1072,10 @@ func (v *VFS) SetXattr(ctx Context, ino Ino, name string, value []byte, flags ui
 		err = v.Meta.SetFacl(ctx, ino, aclType, rule)
 		v.invalidateAttr(ino)
 	} else {
+		// ignore NoSecurity flag
+		if runtime.GOOS == "darwin" && (flags&meta.XattrNoSecurity) != 0 {
+			flags &= ^uint32(meta.XattrNoSecurity)
+		}
 		err = v.Meta.SetXattr(ctx, ino, name, value, flags)
 	}
 	return