evm_inode_removexattr(9)

🎀 NAME 🎀

evm_inode_removexattr — protect the EVM extended attribute 💖 like a tiny bodyguard for the EVM extended attribute, bestie.

hey bestie, welcome to the evm_inode_removexattr(9) page from the Kernel API Manual ✨ this one's short and sweet but it still matters, okay?

✨ SYNOPSIS ✨

int evm_inode_removexattr (struct mnt_idmap *idmap , struct dentry
       *dentry , const char *xattr_name );

🦋 ARGUMENTS 🦋

• idmap — idmap of the mount 🗺️
• dentry — pointer to the affected dentry 🌸
• xattr_name — pointer to the affected extended attribute name 🏷️

💅 DESCRIPTION 💅

okay so here's the tea: removing 'security.evm' is not a casual little tap. it requires CAP_SYS_ADMIN privileges, and the current value has to be valid. that's the whole vibe check ✅ no cap.

👀 SEE ALSO 👀

• the kernel file ./security/integrity/evm/evm_main.c 📁
• evm_read_protected_xattrs(9)
• evm_verifyxattr(9)
• evm_inode_setxattr(9)
• evm_inode_set_acl(9)
• evm_inode_remove_acl(9)
• evm_metadata_changed(9)
• evm_revalidate_status(9)
• evm_fix_hmac(9)
• evm_inode_post_setxattr(9)
• evm_inode_post_set_acl(9)
• evm_inode_post_removexattr(9)
• evm_inode_post_remove_acl(9)
• evm_inode_setattr(9)
• evm_inode_post_setattr(9)

and that's the whole page, bestie 🫶 source/version: ./security/integrity/evm; date: October 2026; function: evm_inode_removexattr(9). mwah 💋✨