NAMEI(9)

💖 NAME 💖

okay bestie, welcome to NAMEI(9) from the Kernel Developer's Manual ✨ this whole page is about namei, NDINIT, NDINIT_AT, and NDFREE_PNBUF — the pathname translation and lookup operations squad 🫶

---

✨ SYNOPSIS ✨

#include <sys/param.h>
#include <sys/fcntl.h>
#include <sys/namei.h>

int
namei(struct nameidata *ndp);

void
NDINIT(struct nameidata *ndp, enum nameiop op, u_int64_t flags,
    enum uio_seg segflg, const char *namep);

void
NDINIT_AT(struct nameidata *ndp, enum nameiop op, u_int64_t flags,
    enum uio_seg segflg, const char *namep, int dirfd);

void
NDFREE_PNBUF(struct nameidata *ndp);

---

🌸 DESCRIPTION 🌸

so the namei facility is what lets a client do pathname translation and lookup operations 💅 the namei functions will increment the reference count for the vnode in question. after you’re done using that vnode, the refcount has to be decremented — you do that with either vrele(9) or vput(9), depending on whether the LOCKLEAF flag was specified or not.

🚨 bestie please don’t forget the vnode refcount cleanup. this is one of those “the vibes are fine but the kernel will absolutely notice” situations 😭

the NDINIT() macro is used to initialize namei components. it takes these arguments:

• ndp — a pointer to the struct nameidata you’re initializing.
• op — the operation that namei() will perform. valid operations are: LOOKUP, CREATE, DELETE, and RENAME. the latter three are just setup for those effects; just calling namei() will not result in VOP_RENAME() being called.
• flags — operation flags, described in the next section. several of these can be effective at the same time.
• segflg — UIO segment indicator. this says whether the name of the object is in userspace (UIO_USERSPACE) or in the kernel address space (UIO_SYSSPACE).
• namep — pointer to the component’s pathname buffer (the file or directory name that will be looked up).

the NDINIT_AT() macro is similar to NDINIT(), but it takes one extra argument:

• dirfd — file descriptor referencing a directory, or the special value AT_FDCWD, which means the calling thread’s current working directory. lookups will be performed relative to this directory.

the NDFREE_PNBUF() macro is used to free the pathname buffer. it must be called exactly once for each successful namei() call. it takes this argument:

• ndp — a pointer to a struct nameidata that was used in a successful namei() call.

---

🌈 NAMEI OPERATION FLAGS 🌈

the namei() function takes this set of “operation flags” that influence how it operates:

• NC_NOMAKEENTRY — an alias for NOCACHE.
• NC_KEEPPOSENTRY — keep the positive-caching entry in cache. this flag is typically combined with NOCACHE so it does not cache a new entry but keeps the existing one, or combined with MAKEENTRY.
• NOCACHE — avoid namei() creating this entry in the namecache if it is not already present. normally, namei() will add entries to the name cache if they are not already there.
• LOCKLEAF — lock vnode on return with LK_EXCLUSIVE unless LOCKSHARED is also set. VOP_UNLOCK(9) should be used to release the lock (or vput(9), which is equivalent to calling VOP_UNLOCK(9) followed by vrele(9), all in one).
• LOCKPARENT — this flag lets the namei() function return the parent (directory) vnode, ni_dvp, in locked state, unless it is identical to ni_vp, in which case ni_dvp is not locked per se (but may be locked due to LOCKLEAF). if a lock is enforced, it should be released using vput(9) or VOP_UNLOCK(9) and vrele(9).
• WANTPARENT — this flag allows the namei() function to return the parent (directory) vnode in an unlocked state. the parent vnode must be released separately by using vrele(9).
• FAILIFEXISTS — makes the namei operation fail if the target exists. it requires that the LOCKPARENT flag is set and LOCKLEAF is not.
• FOLLOW — with this flag, namei() will follow the symbolic link if the last part of the path supplied is a symbolic link (i.e., it will return a vnode for whatever the link points at, instead of the link itself).
• EMPTYPATH — for a namei call initialized with NDINIT_AT(), allow the namep path to be empty. in this case, the dirfd file descriptor may reference a file of arbitrary type, not necessarily a directory, and lookup returns the vnode for this file.
• LOCKSHARED — lock vnode on return with LK_SHARED, if permitted by the file system that owns the vnode. the file system must explicitly permit this by setting MNTK_LOOKUP_SHARED in mp->mnt_kern_flag during mount and by calling VN_LOCK_ASHARE() when allocating the vnode. if LOCKLEAF is specified but shared locking is not permitted, then the vnode will be returned with LK_EXCLUSIVE. VOP_UNLOCK(9) should be used to release the lock (or vput(9), which is equivalent to calling VOP_UNLOCK(9) followed by vrele(9), all in one).
• NOFOLLOW — do not follow symbolic links (pseudo). this flag is not looked for by the actual code, which looks for FOLLOW. NOFOLLOW is used to indicate to the source code reader that symlinks are intentionally not followed.
• RBENEATH — requires that namei did not cross the dirfd directory. the flag is used to implement the O_RESOLVE_BENEATH flag for openat(2).
• NAMEILOOKUP — the component is embedded in a namei lookup structure, and the vfs_lookup_nameidata() function can be used to obtain that structure. this can be useful in VOP_LOOKUP(9) implementations which need to obtain extra lookup metadata.

---

🧚 PARAMETERS DESCRIPTORS FLAGS 🧚

these flags are used for several purposes. some of them affect the global namei operation, and some provide information for processing of the specific path element — for instance, by the VOP_LOOKUP implementation of the involved filesystem 👑

• RDONLY — specifies that the lookup should act as if the final node is located on a read-only mount. the flag is typically used by file servers, e.g. NFS, to handle read-only exports.
• ISRESTARTED — the namei was restarted with NDRESTART(). this is used internally for double-root lookups used by ABI subsystems, after the lookup with native root failed. the components are reset to the original values, and lookup is repeated with a different root, once.
• IGNOREWHITEOUT — ignore whiteouts, e.g. when checking if a directory is empty.
• ISWHITEOUT — the result of lookup is whiteout.
• DOWHITEOUT — handle whiteouts, the instruction for the VOP_LOOKUP() filesystem methods.
• WILLBEDIR — the lookup is done for creating a new entry that will be a directory. it allows the trailing slash in the path string.
• ISOPEN — the caller is the code that opens a file. this allows weakening the lock mode of the returned vnode, if the mount point indicates extended shared lock support.
• NOCROSSMOUNT — do not cross mount points during lookup.
  • For .. lookup leading to mount root, returns the root vnode of the mount instead of the covered vnode of the filesystem where the mount was placed.
  • For other lookups passing over mount, do not jump into the mounted filesystem. this allows descending into the file hierarchy otherwise shadowed by the mount point.
• NOMACCHECK — do not perform MAC checks during lookup.
• AUDITVNODE1 — audit the looked up vnode information, use the first slot for audit information.
• AUDITVNODE2 — same as AUDITVNODE1 but use the second slot.
• NOCAPCHECK — do not perform capability checks. if the calling process is in capability mode, lookup is denied outright.
• OPENREAD — the lookup was for open and the file will be opened for read.
• OPENWRITE — the lookup was for open and the file will be opened for write.
• WANTIOCTLCAPS — leave ioctl caps for the caller. see the description of namei results.
• OPENNAMED — opening a named attribute (directory).
• NOEXECCHECK — do not perform check for allowed execution on the starting directory. it is used to implement the POSIX-required semantic for openat(2) lookups that must use the permissions from the time the directory was opened, and not when used for lookup.
• MAKEENTRY — looked-up entry is to be added to name cache.
• ISSYMLINK — current component is symlink, and it needs the interpretation according to the FOLLOW or NOFOLLOW flags.
• ISLASTCN — this is the last component of pathname. it is handled specially, and many flags augment its processing.
• ISDOTDOT — current component name is ... usually implies a need to specially handle the vnode locking for instantiation of the target vnode. the generic vn_vget_ino_gen() function and its more specialized variant vn_vget_ino() might be useful.
• TRAILINGSLASH — path ended in a slash.
• CREATENAMED — create a named attribute dir.

✨ ALLOCATED ELEMENTS ✨

okay so the nameidata structure is literally a little bundle of fields, and here's the whole squad, bestie:

• ni_startdir — in the normal case this is either the current directory or the root, periodt. It's the current directory if the name you passed in does not start with / and we haven't gone through any symlinks with an absolute path — and it's the root otherwise. 🎀 In this case it's only used by vfs_lookup(), and you should not consider it valid after a call to namei(). like, it's done, she's retired, let her go.
• ni_dvp — the vnode pointer to the directory of the object on which lookup is performed. This one's available on successful return if LOCKPARENT or WANTPARENT is set. And it is locked if LOCKPARENT is set. 🔒
• ni_vp — vnode pointer to the resulting object, NULL otherwise. The v_usecount field of this vnode is incremented. And if LOCKLEAF is set, it's also locked. iconic behavior honestly.
• ni_cnd.cn_pnbuf — the pathname buffer, bestie. It contains the location of the file or directory that will be used by the namei operations. It's managed by the uma(9) zone allocation interface. 🦋

---

🌈 RESULTS 🌈

the struct namei member ni_resflags returns the following flags, which give you some details about the successful operation (yes, it's "succesfull" in the original, she's quirky like that 😭):

• NIRES_ABS — the path passed was absolute.
• NIRES_STRICTREL — restricted lookup result. Only relative lookups were done to resolve the path to vnode.
• NIRES_EMPTYPATH — the EMPTYPATH flag was provided and used. In particular, the passed path was empty. 🙈

and if the WANTIOCTLCAPS flag was specified, then on return the ni_filecaps member of the struct namei contains the capabilities of the file descriptor used as the lookup starting point (dirfd). 👑

---

💖 RETURN VALUES 💖

if it slays, namei() returns 0. otherwise it returns an error. that's it, that's the whole vibe check. ✨

---

🎀 FILES 🎀

src/sys/kern/vfs_lookup.c

---

🦋 EXAMPLES 🦋

so let's say your path variable contains a pointer to a userspace path string — the following example looks up the file named by it, and does all the required error and resource handling. like a responsible main character. 💅

char *path;
struct nameidata nd;
int error;

NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, UIO_USERSPACE,
    path);
if ((error = namei(&nd)) != 0)
        return (error);
NDFREE_PNBUF(&nd);
... use nd.ni_vp vnode

---

💀 ERRORS 💀

the errors namei() may return, no cap:

• [ENOTDIR] — a component of the specified pathname is not a directory when a directory is expected.
• [ENAMETOOLONG] — a component of a pathname exceeded 255 characters, or an entire pathname exceeded 1023 characters. that's a lot of characters, babe.
• [ENOENT] — a component of the specified pathname does not exist, or the pathname is an empty string.
• [EACCES] — an attempt is made to access a file in a way forbidden by its file access permissions. rude.
• [ELOOP] — too many symbolic links were encountered in translating the pathname. she went in circles bestie 🌸
• [EISDIR] — an attempt is made to open a directory with write mode specified.
• [EINVAL] — the last component of the pathname specified for a DELETE or RENAME operation is ..
• [EROFS] — an attempt is made to modify a file or directory on a read-only file system.

---

🫶 SEE ALSO 🫶

uio(9), uma(9), VFS(9), vnode(9), vput(9), vref(9), vrele(9)

like the whole friend group, go say hi 💜

---

👑 AUTHORS 👑

this manual page was written by Eivind Eklund <eivind@FreeBSD.org> and later significantly revised by Hiten M. Pandya <hmp@FreeBSD.org>. absolute legends, we stan. 🌟

---

😭 BUGS 😭

heads up bestie, this one's real: the LOCKPARENT flag does not always result in the parent vnode being locked. this results in complications when LOCKPARENT is used. and in order to solve this for the cases where both LOCKPARENT and LOCKLEAF are used, it is necessary to resort to recursive locking. so like... be careful, okay? not me crying about vnode locking 💀

---

aaaand that's a wrap on the whole page, bestie!! 🎉 this one's from Debian, dated September 30, 2025, and honestly the way she ate... mwah 💅✨ go forth and look up paths responsibly 🦋💜