getxattr(2)

💖 getxattr(2) — the extended attribute value getter 💖

okay bestie so this is the manual page for getxattr, lgetxattr, and fgetxattr from section 2 of the Linux man-pages (system calls, the real ones) 🦋

---

✨ NAME ✨

getxattr, lgetxattr, fgetxattr — retrieve an extended attribute value 💅

---

📚 LIBRARY 📚

Standard C library (libc, -lc)

---

🎀 SYNOPSIS 🎀

#include <sys/xattr.h>

ssize_t getxattr(size_t size;
                 const char *path, const char *name,
                 void value[size], size_t size);
ssize_t lgetxattr(size_t size;
                 const char *path, const char *name,
                 void value[size], size_t size);
ssize_t fgetxattr(size_t size;
                 int fd, const char *name,
                 void value[size], size_t size);

---

🌸 DESCRIPTION 🌸

so like. extended attributes are these little name:value pairs that live on inodes (files, directories, symbolic links, literally all of them). they're like the extra extra — extensions to the normal attributes that every inode in the system already has (you know, the stat(2) data). the whole big-picture lore is in xattr(7), go read it, it's giving encyclopedia 🧚

getxattr() fetches the value of the extended attribute identified by name that's chillin' with the given path in the filesystem. the value gets dropped into the buffer that value points at, and size tells it how big that buffer is. what it returns? the number of bytes it placed into value. periodt. 💖

lgetxattr() is literally getxattr() twin except for one lil' plot twist: if path is a symbolic link, it interrogates the link itself, not the file the link is pointing at. don't get it twisted 🙈

fgetxattr() is also identical to getxattr(), only instead of a path you hand it an open file referred to by fd (as returned by open(2)). main character energy, same vibes 💜

an extended attribute name is a null-terminated string. it includes a namespace prefix — and a single inode can have several, disjoint namespaces hanging out on it, no drama. the value of an extended attribute is just a chunk of arbitrary textual or binary data that somebody assigned using setxattr(2). 🍓

and here's the iconic lil' trick: if you set size to zero, these calls return the current size of the named extended attribute and leave value unchanged. perfect for figuring out how big your buffer needs to be before the next call. 😌

BUT. bear in mind there's a real possibility the attribute value changes between those two calls — so you still have to check the return status from the second call. no skipping that, bestie, fr fr. 😭

---

⭐ RETURN VALUE ⭐

slay: on success these calls return a nonnegative value, which is the size in bytes of the extended attribute value.

flop: on failure, -1 is returned and errno gets set to tell you what went wrong. 💀

---

🔥 ERRORS 🔥

• E2BIG — the attribute value is bigger than the max size allowed, so the attribute just cannot be retrieved. this can happen on filesystems that support very large attribute values, NFSv4 for example. it's giving too much 🫶
• ENODATA — the named attribute does not exist, OR the process has no access to this attribute. either way: nothing there for you.
• ENOTSUP — extended attributes aren't supported by the filesystem, or they're disabled. 😔
• ERANGE — your value buffer is too small to hold the result. buffer said "not today."

plus, the errors documented in stat(2) can also occur. so yeah, check those too. ✨

---

🌈 STANDARDS 🌈

Linux. that's it, that's the standard. 💅

---

👑 HISTORY 👑

Linux 2.4, glibc 2.3. old money, honestly. 🎀

---

💖 EXAMPLES 💖

See listxattr(2). not me making you go read another page, but it's worth it i promise 🦋

---

🌟 SEE ALSO 🌟

getfattr(1), setfattr(1), listxattr(2), open(2), removexattr(2), setxattr(2), stat(2), symlink(7), xattr(7)

---

okay that's the whole page bestie, you're so ready 💜 this was Linux man-pages 6.20, dated 2026-02-08, and yes the page is literally called getxattr(2) — go forth and retrieve those attribute values, you absolute icon, mwah 🎀✨💅