evm_inode_post_setxattr(9)

📦 version 7.3.1, in nixpkgs unstable

💖 evm_inode_post_setxattr(9) 💖

okay so bestie, welcome to the Kernel API Manual ✨ this one's a little kernel function from the EVM corner of the integrity subsystem, and it's honestly not that deep — it just keeps security.evm in sync. let's get into it 🎀

✨ NAME ✨

evm_inode_post_setxattr — update security.evm to reflect the changes 💅

🌸 SYNOPSIS 🌸

void evm_inode_post_setxattr (struct dentry *dentry , const char
*xattr_name , const void *xattr_value , size_t xattr_value_len , int
flags );

like, it returns void, so don't go looking for a return value, there isn't one 🫶

🦋 ARGUMENTS 🦋

  • dentry — pointer to the affected dentry. the inode's little directory-entry buddy that got touched 🎀
  • xattr_name — pointer to the affected extended attribute name. as in, which xattr are we talking about 👀
  • xattr_value — pointer to the new extended attribute value. the fresh new content, periodt ✨
  • xattr_value_len — pointer to the new extended attribute value length. yes, literally the length of xattr_value 💅
  • flags — flags to pass into filesystem operations. the fs gets to see these, so be normal about them 🌸

🔥 DESCRIPTION 🔥

Update the HMAC stored in security.evm to reflect the change. that's the whole vibe — the xattr changed, so the HMAC has to catch up 🦋

and no, you do not need to take the i_mutex lock here, because this function is called from __vfs_setxattr_noperm. and the caller of that has already taken the inode's i_mutex lock. so the locking is handled, bestie, don't double-lock, that's not the move 😭

lowkey important: the no-locking-needed thing is because of the call chain, not because locking doesn't matter. __vfs_setxattr_noperm's caller holds the inode's i_mutex — that's the whole reason this is safe 💜

👑 SEE ALSO 👑

Kernel file ./security/integrity/evm/evm_main.c — the actual source, go read it, it's giving main character energy ⭐

and that's the page, bestie 🫶 this lil icon comes to you from ./security/integrity/evm, dated October 2026 — no cap, that's the source and the date, slay 💖✨🎀

📦 where this page comes from