lookup_dcookie(2)

💫 lookup_dcookie — return a directory entry's path 💫

okay bestie, welcome to lookup_dcookie(2), a little syscall from the System Calls Manual that's honestly giving "only three people on earth use this" energy, but we're gonna learn her anyway because she IS iconic in her own niche way 🎀

---

✨ NAME ✨

lookup_dcookie — returns you the full path of a directory entry, no cap 🌸

---

📚 LIBRARY 📚

Standard C library (libc, -lc) 💜

---

🧚 SYNOPSIS 🧚

#include <sys/syscall.h>      /* Definition of SYS_* constants */
#include <unistd.h>

int syscall(size_t size;
            SYS_lookup_dcookie, uint64_t cookie, char buffer[size],
            size_t size);

Note: glibc provides no wrapper for lookup_dcookie(), so you literally have to go through syscall(2). no shortcut, no easy mode, we're raw-dogging the syscall interface fr fr 💅

---

🦋 DESCRIPTION 🦋

So here's the vibe. You hand her a cookie, and she goes and finds the full path of the directory entry that cookie points at. That cookie is an opaque identifier — meaning it's just a magic number that uniquely identifies one particular directory entry, and you are NOT supposed to peek inside it, bestie, respect her privacy 🙈

The buffer you pass in gets filled with the full path of that directory entry. That's it. That's the whole job. She fills your buffer, she leaves ✨

But listen — for lookup_dcookie() to return successfully, the kernel must still hold a cookie reference to that directory entry. If the kernel has moved on and dropped the reference, it's over, she's not gonna find it, it's giving "you don't know me anymore" 😭

---

💖 RETURN VALUE 💖

• On success, lookup_dcookie() returns the length of the path string that got copied into the buffer. slay.
• On error, -1 is returned, and errno gets set to tell you exactly what went wrong. classic.

---

💀 ERRORS 💀

• EFAULT — the buffer was not valid. like, girl, that pointer? invalid. 🫠
• EINVAL — the kernel has no registered cookie/directory entry mappings at the time of lookup, OR the cookie doesn't refer to a valid directory entry. either way, nothing to look up.
• ENAMETOOLONG — the name could not fit in the buffer. too much name, not enough room 😔
• ENOMEM — the kernel could not allocate memory for the temporary buffer holding the path. even the kernel is out here struggling.
• EPERM — the process does not have the capability CAP_SYS_ADMIN, which is required to look up cookie values. permission denied, bestie, you don't have the badge 🔒
• ERANGE — the buffer was not large enough to hold the path of the directory entry. size matters (in bytes) 💅

---

🌈 STANDARDS 🌈

Linux. that's the whole list, she's a Linux exclusive 💜

---

📜 HISTORY 📜

• Debuted in Linux 2.5.43. vintage ✨
• The ENAMETOOLONG error got added later, in Linux 2.5.70. character development 🎀

---

👑 NOTES 👑

• lookup_dcookie() is a special-purpose system call, and currently it's used only by the oprofile(1) profiler. one user. one loyal user. main character energy honestly 🔥
• It relies on a kernel driver to register cookies for directory entries — so she can't do it alone, she needs backup.
• The path returned may be suffixed by the string " (deleted)" if the directory entry has been removed. yes, she'll tell you it's gone. she's honest like that 🫶

---

👀 SEE ALSO 👀

• oprofile(1)

---

and that's the whole page, bestie!! this one came from the Linux man-pages 6.20, dated 2026-02-08, and it's lookup_dcookie(2) — go forth and look up your directory entries, but only if you've got CAP_SYS_ADMIN and a driver backing you up 💖✨🎀🦋