Patch "ovl: filter trusted xattr for non-admin" has been added to the 4.9-stable tree