FsRtlSetKernelEaFile function (ntifs.h)
The routine FsRtlQueryKernelEaFile is used to set, modify and/or delete extended attribute (EA) values for a file and synchronously wait for it to complete, returning a result. It sets the IRP_MN_KERNEL minor code which allows this API to set SecureEAs. This allows the caller to do this by FileObject instead of a handle.
Syntax
NTSTATUS FsRtlSetKernelEaFile(
[in] PFILE_OBJECT FileObject,
[in] PVOID EaBuffer,
[in] ULONG Length
);
Parameters
[in] FileObject
A pointer to a FileObject to send the QueryEA request to.
[in] EaBuffer
A pointer to a caller-supplied, FILE_FULL_EA_INFORMATION-structured input buffer that contains the extended attribute values to be set
[in] Length
Specifies the length of the EA buffer.
Return value
The routine FsRtlSetKernelEaFile receives the status of the operation and returns one of the status codes:
| Return code | Description |
|---|---|
|
The EaList parameter is not formatted correctly. |
|
The file system does not support extended attributes. |
|
The I/O request packet (IRP) could not be allocated for this request. |
|
The request cannot intermix normal and kernel EA’s in the same call. |
|
The request failed as it was a direct device open. |
|
The request was successful. |
Remarks
This routine assumes all passed in buffers are from kernel mode.
One or more Kernel EA’s may be set, modified and/or deleted in a single call to FsRtlSetKernelEaFile. Normal EA’s may also be set using the FsRtlSetKernelEaFile function. You delete EA’s by specifying an EAName with an EaValueLength of zero. You can intermix inserting new, modifying existing, or removing EA’s in a single call.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows 8 |
| Minimum supported server | Windows Server 2012 |
| Target Platform | Windows |
| Header | ntifs.h |