evm_verifyxattr(9)

💅 evm_verifyxattr(9) — like, the kernel API manual section 9, bestie ✨

okay so this is evm_verifyxattr from the kernel API manual (section 9, yes we're in the big-kid kernel docs now 🎀), and she's the one who does the vibe check on your xattr integrity. stay with me 💖

---

✨ NAME ✨

evm_verifyxattr — verify the integrity of the requested xattr 🫶

---

🌸 SYNOPSIS 🌸

enum integrity_status evm_verifyxattr (struct dentry *dentry , const
char *xattr_name , void *xattr_value , size_t xattr_value_len );

---

🦋 ARGUMENTS 🦋

• dentry — the object of the verify xattr, aka the thing we're checking 💅
• xattr_name — the requested xattr, the name of the one you want ✨
• xattr_value — the requested xattr value, the actual content, slay
• xattr_value_len — the requested xattr value length, so we know how much content we're dealing with 🔥

---

💜 DESCRIPTION 💜

so what she does is: calculate the HMAC for the given dentry and verify it against the stored security.evm xattr. that's the whole job, no cap 👑

for performance, use the xattr value and length previously retrieved to calculate the HMAC — like, don't go refetching stuff you already have, that's so unnecessary 😭

she returns the xattr integrity status. 🌈

⚠️ okay important, fr fr: this function requires the caller to lock the inode's i_mutex before it is executed. not optional, don't skip it, the whole thing is giving "lock first or chaos" 💀

---

👑 SEE ALSO 👑

• Kernel file ./security/integrity/evm/evm_main.c
• evm_read_protected_xattrs(9)
• evm_inode_setxattr(9)
• evm_inode_removexattr(9)
• evm_inode_set_acl(9)
• evm_inode_remove_acl(9)
• evm_metadata_changed(9)
• evm_revalidate_status(9)
• evm_fix_hmac(9)
• evm_inode_post_setxattr(9)
• evm_inode_post_set_acl(9)
• evm_inode_post_removexattr(9)
• evm_inode_post_remove_acl(9)
• evm_inode_setattr(9)
• evm_inode_post_setattr(9)

the whole friend group is here, iykyk 🧚

---

mwah 💋 that's a wrap! this cutie lives in ./security/integrity/evm, dropped October 2026, and the page itself is evm_verifyxattr(9). go lock that i_mutex and verify some xattrs bestie — periodt 💅✨