cap_inode_removexattr(9)

💅 cap_inode_removexattr — the manual page bestie

okay so bestie, this is a Kernel API Manual page for cap_inode_removexattr(9), and no cap it's lowkey iconic — it's the little gatekeeper that decides whether an extended attribute is allowed to get yeeted off an inode. ✨

---

✨ NAME ✨

cap_inode_removexattr — literally the function that determines whether an xattr may be removed. that's it, that's the whole vibe check. 🎀

---

🌸 SYNOPSIS 🌸

int cap_inode_removexattr (struct mnt_idmap *idmap , struct dentry *dentry , const char *name );

---

🦋 ARGUMENTS 🦋

• idmap — the idmap of the mount the inode was found from. yes it's a whole parameter, don't skip it 💅
• dentry — the inode/dentry being altered. this is the main character, the thing we're messing with 🫶
• name — the name of the xattr to be changed. like, which one, bestie? be specific 🌸

---

🔥 DESCRIPTION 🔥

So what it do: it determines whether an xattr may be removed from an inode, returning 0 if permission is granted, and -ve if it's denied. that's the whole deal — 0 means slay, negative means absolutely not. 😭

Now the important bit, and honestly this is giving very careful: if the inode has been found through an idmapped mount, the idmap of the vfsmount must be passed through idmap. This function will then take care to map the inode according to idmap before checking permissions. ✨

on non-idmapped mounts, or if the permission checking is to be performed on the raw inode, just simply pass nop_mnt_idmap. easy. no stress. 💖

And why do we even care? This is used to make sure security xattrs don't get removed by those who aren't privileged to remove them. it's giving bodyguard energy fr fr — the unprivileged do NOT get to touch the security xattrs, periodt. 👑

---

💜 SEE ALSO 💜

Kernel file ./security/commoncap.c — and here's the whole friend group, every single one, no gatekeeping:

• cap_capable_helper(9)
• cap_capable(9)
• cap_settime(9)
• cap_ptrace_access_check(9)
• cap_ptrace_traceme(9)
• cap_capget(9)
• cap_capset(9)
• cap_inode_need_killpriv(9)
• cap_inode_killpriv(9)
• kuid_root_in_ns(9)
• rootid_from_xattr(9)
• cap_convert_nscap(9)
• get_vfs_caps_from_disk(9)
• cap_bprm_creds_from_file(9)
• cap_inode_setxattr(9)
• cap_task_fix_setuid(9)
• cap_task_setscheduler(9)
• cap_task_setioprio(9)
• cap_task_setnice(9)
• cap_task_prctl(9)
• cap_vm_enough_memory(9)
• cap_mmap_addr(9)

---

that's the page bestie, you ate it up 💅✨ and real quick, the cute lil sign-off credits: this one lives in ./security and it's dated October 2026. mwah 🎀🦋💖