evm_inode_setattr(9)
π evm_inode_setattr(9) β a Kernel API Manual moment
ok so bestie, welcome to evm_inode_setattr(9) from the Kernel API Manual β yes that's the manual name, and yes it sounds fancy, but honestly this one's a little bouncer standing at the door of your file attributes. Let me tell you everything, no cap. π«Ά
β¨ SYNOPSIS β¨
int evm_inode_setattr (struct mnt_idmap *idmap , struct dentry *dentry ,
struct iattr *attr );
like, three args, returns an int, it's giving "small function, big responsibility" energy π
π ARGUMENTS π
idmapβ the idmap of the mount. yeah, the whole mount's mapping situation.dentryβ a pointer to the dentry that's getting affected. the actual file-ish thing in question π¦attrβ aniattrstructure holding the new file attributes. i.e. the new fit it's trying to put on β¨
πΈ DESCRIPTION πΈ
okay so here's the vibe: this function permits updating file attributes when files have a valid EVM signature. slay. that's the green light. π
but β and this is the important part, don't skip it β there's one exception: not when the file has an immutable portable signature. in that case? no update. periodt. π₯
so tl;dr: valid EVM signature = you're in. immutable portable signature = absolutely not, the door stays closed. π
π SEE ALSO π
- Kernel file
./security/integrity/evm/evm_main.cβ the source file, go read it iykyk π evm_read_protected_xattrs(9)evm_verifyxattr(9)evm_inode_setxattr(9)evm_inode_removexattr(9)evm_inode_set_acl(9)evm_inode_remove_acl(9)evm_metadata_changed(9)evm_revalidate_status(9)evm_fix_hmac(9)evm_inode_post_setxattr(9)evm_inode_post_set_acl(9)evm_inode_post_removexattr(9)evm_inode_post_remove_acl(9)evm_inode_post_setattr(9)
bestie this is the whole EVM extended-attribute friend group and they ALL showed up to the party. don't leave without saying hi to every single one π§π
and that's the page!! mwah π sign-off time: this lil beauty comes from ./security/integrity/evm and it's dated October 2026 β iconic, timeless, no notes. πβπ
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms