FsRtlSetKernelEaFile function (ntifs.h)

Article
02/22/2024

The routine FsRtlQueryKernelEaFile is used to set, modify and/or delete extended attribute (EA) values for a file and synchronously wait for it to complete, returning a result. It sets the IRP_MN_KERNEL minor code which allows this API to set SecureEAs. This allows the caller to do this by FileObject instead of a handle.

Syntax

NTSTATUS FsRtlSetKernelEaFile(
  [in] PFILE_OBJECT FileObject,
  [in] PVOID        EaBuffer,
  [in] ULONG        Length
);

Parameters

[in] FileObject

A pointer to a FileObject to send the QueryEA request to.

[in] EaBuffer

A pointer to a caller-supplied, FILE_FULL_EA_INFORMATION-structured input buffer that contains the extended attribute values to be set

[in] Length

Specifies the length of the EA buffer.

Return value

The routine FsRtlSetKernelEaFile receives the status of the operation and returns one of the status codes:

Return code	Description
STATUS_EA_LIST_INCONSISTENT	The EaList parameter is not formatted correctly.
STATUS_EAS_NOT_SUPPORTED	The file system does not support extended attributes.
STATUS_INSUFFICIENT_RESOURCES	The I/O request packet (IRP) could not be allocated for this request.
STATUS_INTERMIXED_KERNEL_EA_OPERATION	The request cannot intermix normal and kernel EA’s in the same call.
STATUS_INVALID_DEVICE_REQUEST	The request failed as it was a direct device open.
STATUS_SUCCESS	The request was successful.

Remarks

This routine assumes all passed in buffers are from kernel mode.

One or more Kernel EA’s may be set, modified and/or deleted in a single call to FsRtlSetKernelEaFile. Normal EA’s may also be set using the FsRtlSetKernelEaFile function. You delete EA’s by specifying an EAName with an EaValueLength of zero. You can intermix inserting new, modifying existing, or removing EA’s in a single call.

Requirements

Requirement	Value
Minimum supported client	Windows 8
Minimum supported server	Windows Server 2012
Target Platform	Windows
Header	ntifs.h