bpf_sock_read_xattr(9)

📦 version 7.3.1, in nixpkgs unstable

💖 bpf_sock_read_xattr(9) 💖

okay so bestie, welcome to bpf_sock_read_xattr from the Kernel API Manual (section 9, kernel-space kfuncs, we're in the cool part of the manual) 🎀 this one's a lil baddie that reads an extended attribute off a socket's inode over in sockfs, and it's honestly so useful. let's get into it ✨

🌸 SYNOPSIS 🌸

__bpf_kfunc int bpf_sock_read_xattr (struct socket *sock , const char
*name__str , struct bpf_dynptr *value_p );

literally three args, that's it, no cap. signature copied exactly, don't @ me 💅

🦋 ARGUMENTS 🦋

  • sock — the socket you wanna pull the xattr off of 🧦 this is your main character.
  • name__str — the name of the xattr you're asking for. yes, the double underscore is real, it's not a typo, keep it fr fr.
  • value_p — your output buffer where the xattr value lands. the dynptr holds the goods 🫶

✨ DESCRIPTION ✨

so what it does: it grabs the xattr name__str belonging to sock and stashes the output into value_p. simple, iconic, done 💖

but 💀 — for security reasons, only name__str values with the prefix "user." are allowed. like, that's the whole vibe check. anything without that prefix? not happening. the kernel said no 🙈 so name your xattrs accordingly, bestie.

⚠️ lowkey important: that "user." prefix restriction isn't a suggestion, it's the rule. don't come crying to me when your "trusted." or "security." name gets rejected 😭 security stays winning.

🔥 RETURN 🔥

  • on success 👑 → the length of the xattr value
  • on error 💀 → a negative value

so like, > 0 (or zero-length, whatever the value length is) = slay, negative = nope. check your returns, always, periodt.

💜 SEE ALSO 💜

the whole friend group, all of them, no one left out 🫶 the kernel file lives at ./fs/bpf_fs_kfuncs.c and here's the full squad:

and that's the page!! mwah 💋 this drop came straight out of ./fs and it's dated October 2026, so go forth and read those socket xattrs responsibly, bestie 🌈⭐

📦 where this page comes from