Skip to content

listxattr

Intro

listxattr - retrieves the list of extended attributes associated with a file.

Description

listxattr retrieves the list of extended attributes associated with file referenced by path and stores it in list. The argument size specifies the size of the buffer pointed to by list and may be 0 for when only the size of the attribute list is needed.

The returned attributes are in the form of a list of null-terminated attribute names. No attribute values are retrieved by this call. Attributes can have sizes up to 128 bytes (XATTR_SIZE_MAX).

listxattr can be used to query the list of supported xattrs if the maximum size of an xattr is not known.

Arguments

  • path:const char* - A pathname of item for which to list extended attributes.
  • list:char* - A list of the extended attributes associated with the file.
  • size:size_t - Max buffer size of the buf argument.

Hooks

fcntl

Type

Tracepoint

Purpose

To observe sys calls of applications and kernel activity.

do_listxattr

Type

Kprobe

Purpose

To profile the listxattr syscall.

Example Use Case

listxattr can be used to list or inspect the extended attributes of a file or directory. For example, on a filesystem with POSIX Access Control Lists enabled, listxattr can be used to determine if a user has the correct permissions for a file or directory.

Issues

listxattr does not traverse mounted filesystems, so it will not list an extended attribute located on a mounted filesystem.

getxattr, removexattr, setxattr

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.