getxattr

Reads an extended attribute value by name from a path.

Prototype

user_ssize_t getxattr(user_addr_t path, user_addr_t attrname, user_addr_t value, size_t size, uint32_t position, int options);

Returns: user_ssize_t

Arguments

Name	Type	Dir
path	user_addr_t	-
attrname	user_addr_t	-
value	user_addr_t	-
size	size_t	-
position	uint32_t	-
options	int	-

Version history

XNU tag	macOS	#
xnu-1456.1.26	macOS 10.6 Snow Leopard	234
xnu-1699.24.8	macOS 10.7 Lion	234
xnu-2050.18.24	macOS 10.8 Mountain Lion	234
xnu-2422.115.4	macOS 10.9 Mavericks	234
xnu-2782.40.9	macOS 10.10 Yosemite	234
xnu-3247.1.106	macOS 10.11 El Capitan	234
xnu-3789.1.32	macOS 10.12 Sierra	234
xnu-4570.1.46	macOS 10.13 High Sierra	234
xnu-4903.221.2	macOS 10.14 Mojave	234
xnu-6153.11.26	macOS 10.15 Catalina	234
xnu-7195.50.7.100.1	macOS 11.0 Big Sur	234
xnu-8019.41.5	macOS 12.0 Monterey	234
xnu-8792.41.9	macOS 13.0 Ventura	234
xnu-10002.1.13	macOS 14.0 Sonoma	234
xnu-11215.1.10	macOS 15.0 Sequoia	234
xnu-11417.101.15	macOS 15.4 Sequoia	234
xnu-12377.1.9	macOS 26.0 Tahoe	234
xnu-10002.41.9	—	234
xnu-10002.61.3	—	234
xnu-10002.81.5	—	234
xnu-10063.101.15	—	234
xnu-10063.121.3	—	234
xnu-10063.141.1	—	234
xnu-11215.41.3	—	234
xnu-11215.61.5	—	234
xnu-11215.81.4	—	234
xnu-11417.121.6	—	234
xnu-11417.140.69	—	234
xnu-12377.101.15	—	234
xnu-12377.41.6	—	234
xnu-12377.61.12	—	234
xnu-12377.81.4	—	234
xnu-1486.2.11	—	234
xnu-1504.15.3	—	234
xnu-1504.3.12	—	234
xnu-1504.7.4	—	234
xnu-1504.9.17	—	234
xnu-1504.9.26	—	234
xnu-1504.9.37	—	234
xnu-1699.22.73	—	234
xnu-1699.22.81	—	234
xnu-1699.24.23	—	234
xnu-1699.26.8	—	234
xnu-1699.32.7	—	234
xnu-2050.22.13	—	234
xnu-2050.24.15	—	234
xnu-2050.48.11	—	234
xnu-2050.7.9	—	234
xnu-2050.9.2	—	234
xnu-2422.1.72	—	234
xnu-2422.100.13	—	234
xnu-2422.110.17	—	234
xnu-2422.90.20	—	234
xnu-2782.1.97	—	234
xnu-2782.10.72	—	234
xnu-2782.20.48	—	234
xnu-2782.30.5	—	234
xnu-3247.10.11	—	234
xnu-3248.20.55	—	234
xnu-3248.30.4	—	234
xnu-3248.40.184	—	234
xnu-3248.50.21	—	234
xnu-3248.60.10	—	234
xnu-3789.21.4	—	234
xnu-3789.31.2	—	234
xnu-3789.41.3	—	234
xnu-3789.51.2	—	234
xnu-3789.60.24	—	234
xnu-3789.70.16	—	234
xnu-4570.20.62	—	234
xnu-4570.31.3	—	234
xnu-4570.41.2	—	234
xnu-4570.51.1	—	234
xnu-4570.61.1	—	234
xnu-4570.71.2	—	234
xnu-4903.231.4	—	234
xnu-4903.241.1	—	234
xnu-4903.270.47	—	234
xnu-6153.101.6	—	234
xnu-6153.121.1	—	234
xnu-6153.141.1	—	234
xnu-6153.41.3	—	234
xnu-6153.61.1	—	234
xnu-6153.81.5	—	234
xnu-7195.101.1	—	234
xnu-7195.121.3	—	234
xnu-7195.141.2	—	234
xnu-7195.60.75	—	234
xnu-7195.81.3	—	234
xnu-8019.61.5	—	234
xnu-8019.80.24	—	234
xnu-8020.101.4	—	234
xnu-8020.121.3	—	234
xnu-8020.140.41	—	234
xnu-8792.61.2	—	234
xnu-8792.81.2	—	234
xnu-8796.101.5	—	234
xnu-8796.121.2	—	234
xnu-8796.141.3	—	234

Notes

Passing a NULL buffer returns the value size, useful for sizing the real read. macOS uses xattrs to carry Finder info, resource forks, quarantine metadata (com.apple.quarantine) and code signature data on bundles. Names beginning with com.apple are reserved.

Detection

ES emits ES_EVENT_TYPE_NOTIFY_GETEXTATTR on supported versions. syscall::getxattr:entry in DTrace.

Related APIs

fgetxattrsetxattrlistxattrremovexattr