cap_inode_setxattr(9)

📦 version 7.3.1, in nixpkgs unstable

💅 cap_inode_setxattr — the kernel API manual, bestie edition 🎀

okay so this is cap_inode_setxattr, and it lives in the Kernel API Manual section (9). Yes bestie, section 9 — that's the kernel-internals one. Buckle up. 🦋

✨ NAME ✨

cap_inode_setxattr — the little function that decides whether an xattr is even allowed to be altered. It's the bouncer at the club door for extended attributes. 💅

🌸 SYNOPSIS 🌸

int cap_inode_setxattr (struct dentry *dentry , const char *name , const
void *value , size_t size , int flags );

Look at that signature. Gorgeous. Iconic. Returns an int, takes five args, and yes you need all of them. 🫶

🎀 ARGUMENTS 🎀

  • dentry — the inode/dentry that's getting altered. the main character of this whole operation tbh 👑
  • name — the name of the xattr that's about to be changed 🏷️
  • value — the value that the xattr will be changed to. like, the glow-up it's getting ✨
  • size — the size of value. how big the glow-up is 📏
  • flags — the replacement flag 🚩

💜 DESCRIPTION 💜

So what does it actually do? It determines whether an xattr may be altered or set on an inode, and it hands back 0 if permission is granted, or -ve if it's denied. That's it. That's the vibe check. 😭

Lowkey the important part: this is used to make sure security xattrs don't get updated or set by people who aren't privileged to do so. No cap — it's a security gate, and it takes that job very seriously. 🔥

fr fr, don't treat the return value as a suggestion. 0 = go, -ve = absolutely not, bestie. 💀

🦋 SEE ALSO 🦋

Kernel file ./security/commoncap.c — go read it if you're built different — and the whole squad, in this exact order, no skipping:

🌈 the cute sign-off 🌈

this page came out of the ./security directory, dated October 2026, and it's officially the cap_inode_setxattr(9) page — so you literally cannot get lost. iykyk. mwah 💋💖

periodt. 🧚‍♀️

📦 where this page comes from