evm_inode_set_acl(9)

🌸 evm_inode_set_acl(9) 🌸

okay bestie, welcome to the Kernel API Manual page for evm_inode_set_acl(9) — it's giving “security checkpoint for your EVM xattr” energy, and honestly? iconic. 💅✨

✨ NAME ✨

evm_inode_set_acl — protect the EVM extended attribute from posix acls 🛡️

🫶 SYNOPSIS 🫶

       int evm_inode_set_acl (struct mnt_idmap *idmap , struct dentry *dentry ,
       const char *acl_name , struct posix_acl *kacl );

🎀 ARGUMENTS 🎀

• idmap — idmap of the idmapped mount 🗺️
• dentry — pointer to the affected dentry 📍
• acl_name — name of the posix acl 🏷️
• kacl — pointer to the posix acls 🧺

💖 DESCRIPTION 💖

So here’s the tea, bestie ☕: this function prevents modifying posix acls from causing the EVM HMAC to be re-calculated and the 'security.evm' xattr to be updated — unless the existing 'security.evm' is valid. 🫶

no cap, that unless is lowkey doing a lot of work here 😭

🔥 RETURN 🔥

It returns zero on success 🎉 and -EPERM on failure 💀.

🌈 SEE ALSO 🌈

• Kernel file ./security/integrity/evm/evm_main.c — the source, go read it 📖
• evm_read_protected_xattrs(9)
• evm_verifyxattr(9)
• evm_inode_setxattr(9)
• evm_inode_removexattr(9)
• evm_inode_remove_acl(9)
• evm_metadata_changed(9)
• evm_revalidate_status(9)
• evm_fix_hmac(9)
• evm_inode_post_setxattr(9)
• evm_inode_post_set_acl(9)
• evm_inode_post_removexattr(9)
• evm_inode_post_remove_acl(9)
• evm_inode_setattr(9)
• evm_inode_post_setattr(9)

signed off from source/version ./security/integrity/evm, dated October 2026, as evm_inode_set_acl(9) 🎀💜