evm_inode_remove_acl(9)

📦 version 7.3.1, in nixpkgs unstable

💅 evm_inode_remove_acl(9) 💅

okay so bestie, this is a page straight out of the Kernel API Manual — it's evm_inode_remove_acl(9), and it's lowkey one of the most protective little functions in the whole EVM squad. let's get into it 🫶

✨ NAME ✨

evm_inode_remove_acl — protect the EVM extended attribute from posix acls 🛡️✨

🌸 SYNOPSIS 🌸

int evm_inode_remove_acl (struct mnt_idmap *idmap , struct dentry *dentry , const char *acl_name );

🎀 ARGUMENTS 🎀

  • idmap — the idmap of the mount, she's giving "which mount are we even talking about" energy 💫
  • dentry — pointer to the affected dentry, aka the actual file-ish thing we're messing with 🦋
  • acl_name — name of the posix acl, literally just the name, no cap 💅

🌈 DESCRIPTION 🌈

so the whole point here is preventing posix acls from being removed in a way that would cause the EVM HMAC to be re-calculated and the 'security.evm' xattr to get updated — unless the existing 'security.evm' is valid, okay?? that's the vibe check. 🧚

like, this function is the bouncer at the club, and the club is your 'security.evm' xattr. nobody touches it unless they're on the list. periodt. 👑

⭐ RETURN ⭐

  • zero on success — slay, we ate 💖
  • -EPERM on failure — not today, bestie 😭🙈
ngl, if you see -EPERM, the operation was not permitted. that's it, that's the whole tea. 💀

🔥 SEE ALSO 🔥

the kernel file lives at ./security/integrity/evm/evm_main.c if you wanna go read the source like the main character you are 📖✨

and here's the whole friend group, they're all iconic:

and that's the page!! this little baddie comes to you from ./security/integrity/evm and she's dated October 2026 — go forth and protect those xattrs, bestie 🦋💜✨

📦 where this page comes from