bpf_set_dentry_xattr_locked(9)
π bpf_set_dentry_xattr_locked(9) β from the Kernel API Manual, bestie β¨
okay so picture this: you're deep in kernel-land, you've got a dentry, you've got an xattr name, you've got a value, and you just need to stick that value onto that dentry. that's this function. it's giving lowkey niche but highkey iconic. let's get into it π«Ά
β¨ NAME β¨
bpf_set_dentry_xattr_locked β set a xattr of a dentry π
πΈ SYNOPSIS πΈ
int bpf_set_dentry_xattr_locked (struct dentry *dentry , const char
*name__str , const struct bpf_dynptr *value_p , int flags );
like, that's the whole signature, no notes, she's beautiful π
π ARGUMENTS π
dentryβ the dentry you're pulling the xattr from. that's the main character right there πname__strβ the name of the xattr. and yes bestie, the double underscore is real, that's not a typo, write it exactly like that πvalue_pβ the xattr value. this is the actual payload, the vibe, the content πflagsβ flags that get passed straight into filesystem operations. so whatever the fs wants, the fs gets π§
π¦ DESCRIPTION π¦
so what she actually does: she sets the xattr name__str of dentry to the value in value_ptr. that's the whole assignment. slay β¨
β οΈ and now the important part, no cap: for security reasons, onlyname__strwith the prefix"security.bpf."is allowed. that's not a suggestion, that's the rule. anything else? not today, bestie π
also, heads up: the caller already locked dentry->d_inode. that's on you, not on her. she's not doing the locking, she's just showing up to a party that's already locked (in a good way) π₯
β RETURN β
0on success π- a negative value on error π
that's it. binary queen. periodt π
π SEE ALSO π
- Kernel file
./fs/bpf_fs_kfuncs.cβ that's where the magic lives π
and the whole friend group, obviously:
bpf_get_task_exe_file(9)bpf_put_file(9)bpf_path_d_path(9)bpf_get_dentry_xattr(9)bpf_get_file_xattr(9)bpf_remove_dentry_xattr_locked(9)bpf_set_dentry_xattr(9)bpf_remove_dentry_xattr(9)bpf_cgroup_read_xattr(9)bpf_sock_read_xattr(9)bpf_real_data_inode(9)
like, the whole xattr cinematic universe fr fr πΈ
okay and finally, the lil sign-off: this page comes from ./fs, dated October 2026, and it's all about bpf_set_dentry_xattr_locked(9). mwah π go forth and set those xattrs, but only the "security.bpf." ones, iykyk π
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms