evm_write_xattrs(9)

💅 evm_write_xattrs(9) — Kernel API Manual

okay bestie, so this one is evm_write_xattrs(9) from the Kernel API Manual, and it's literally the write() side of <securityfs>/evm_xattrs 🌸 like, that's the whole vibe. she writes, she doesn't read. main character energy only ✨

---

🎀 SYNOPSIS 🎀

ssize_t evm_write_xattrs (struct file *file , const char __user *buf ,
size_t count , loff_t *ppos );

that's the signature, no cap. four args, all of them important-ish (okay, one of them is not actually used, we'll get there 🙈).

---

🦋 ARGUMENTS 🦋

• file — file pointer. and honestly? not actually used. she's there for the vibes, she's a placeholder, she showed up to the group chat and said nothing 💀
• buf — where to get the data from 💖 this is the actual tea, the bytes live here (in user space, hence the __user)
• count — bytes sent. how many bytes are we working with, bestie 🧚
• ppos — where to start. the offset, the beginning of the story, the "we begin at this point" 🌸

---

⭐ DESCRIPTION ⭐

returns the number of bytes written, or an error code, as appropriate. that's it, that's the whole description 😭 she does one thing and she does it slayfully. if it works you get a count back, if it doesn't you get an error code — pick your fighter 🫶

no extra behaviour is documented here, so don't come for me with "but what about—" because the manpage says what the manpage says, periodt 💅

---

👑 SEE ALSO 👑

• Kernel file ./security/integrity/evm/evm_secfs.c
• evm_read_key(9)
• evm_write_key(9)
• evm_read_xattrs(9)

go read those if you want the fuller picture, iykyk 🔥

---

and that's the page, babe 🌈 this iconic little number lives in ./security/integrity/evm and it's dated October 2026 — yes, the future, we're ahead of schedule, we ate 💜🎀🦋