security_ino...nit_security(9)

💅 security_inode_init_security(9) 💅

okay so bestie, welcome to the Kernel API Manual ✨ — we're literally about to talk about security_inode_init_security, and honestly? she's kind of a big deal. inode creation, but make it secure. no cap. 🎀

🌸 NAME 🌸

security_inode_init_security — Initialize an inode's LSM context 💖

like, it sets up the security vibes for a brand-new inode. that's the whole thing. iconic.

✨ SYNOPSIS ✨

int security_inode_init_security (struct inode *inode , struct inode
*dir , const struct qstr *qstr , const initxattrs initxattrs , void
*fs_data );

look at her go 😭 five whole arguments. she's thorough. we respect that.

🦋 ARGUMENTS 🦋

inode — the inode. yeah. THE inode. main character energy, obviously 👑
dir — the parent directory, i.e. inode's mom basically 🫶
qstr — the last component of the pathname 🌸
initxattrs — callback function to write xattrs ✍️
fs_data — filesystem specific data 🍓

💜 DESCRIPTION 💜

okay so here's the tea, bestie ☕:

this function obtains the security attribute name suffix and value to set on a newly created inode, and sets up the incore security field for that new inode. so it's like the inode's little security birth certificate 🎀✨

this hook is called by the fs code as part of the inode creation transaction, and it provides for atomic labeling of the inode. and that's the key difference — it's atomic, unlike the post_create/mkdir/... hooks called by the VFS. so she does it all in one transaction instead of showing up fashionably late 💅

ngl, that distinction matters. the other hooks are the VFS-era group chat; this one is the actual transaction. don't mix them up. 🙈

🧚 what the hook function is expected to do, bestie 🧚

so the hook function is expected to populate the xattrs array — and the way you do that is by calling lsm_get_xattr_slot to retrieve the slots reserved by the security module with the lbs_xattr_count field of the lsm_blob_sizes structure. so far so good? 🦋

for each slot, the hook function should:

set ->name to the attribute name suffix (e.g. selinux) 🏷️
allocate ->value — and heads up, this will be freed by the caller, so like, don't you dare free it yourself 🔥
set ->value to the attribute value
set ->value_len to the length of the value 📏

and if the security module doesn't use security attributes, or just doesn't wish to put a security attribute on this particular inode? then it should return -EOPNOTSUPP to skip this processing. that's it. no drama, no guilt trip, just skip. 🫶

🌈 RETURN 🌈

returns 0 if the LSM successfully initialized all of the inode security attributes that are required ✨ — negative values otherwise 😭

like. zero means slay. negative means something went sideways. that's the vibe check. ⭐

🎀 SEE ALSO 🎀

Kernel file ./security/security.c — plus, and I'm not even kidding, an entire ecosystem of friends 💖 here's the full squad, in order, no skips:

and that's the whole page, bestie. you ate. 💅✨

ngl that SEE ALSO section is giving phonebook. but every single one of those is real and you're gonna want them someday, iykyk. 📖💀

okay that's a wrap! this one came out of the ./security source, dated October 2026 — she's fresh, she's iconic, and she's staying in the group chat. 🎀🦋⭐ bye bestie, go secure an inode 💖

📦 where this page comes from

nixpkgs unstable: linux-manual 7.3.1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms