a-shannon · Aug 9, 2026
diff --git a/src/backend/libc/fs/syscalls.rs b/src/backend/libc/fs/syscalls.rs
@@ -2485,6 +2485,46 @@ pub(crate) unsafe fn fgetxattr(
     }
 }
 
+#[cfg(linux_kernel)]
+pub(crate) unsafe fn getxattrat(
+    dirfd: BorrowedFd<'_>,
+    path: &CStr,
+    name: &CStr,
+    value: (*mut u8, usize),
+    flags: AtFlags,
+) -> io::Result<usize> {
+    use linux_raw_sys::general::xattr_args;
+
+    const SYS_GETXATTRAT: c::c_long = linux_raw_sys::general::__NR_getxattrat as c::c_long;
+    syscall! {
+        fn getxattrat_syscall(
+            base_dirfd: c::c_int,
+            path: *const ffi::c_char,
+            at_flags: c::c_uint,
+            name: *const ffi::c_char,
+            args: *const xattr_args,
+            args_size: usize
+        ) via SYS_GETXATTRAT -> c::ssize_t
+    }
+
+    let value_size = value.1.try_into().map_err(|_| io::Errno::OVERFLOW)?;
+    let value_addr = u64::try_from(value.0 as usize).map_err(|_| io::Errno::OVERFLOW)?;
+    let args = xattr_args {
+        value: value_addr,
+        size: value_size,
+        flags: 0,
+    };
+
+    ret_usize(getxattrat_syscall(
+        borrowed_fd(dirfd),
+        c_str(path),
+        flags.bits(),
+        c_str(name),
+        &args,
+        core::mem::size_of::<xattr_args>(),
+    ))
+}
+
 #[cfg(any(apple, linux_kernel, target_os = "hurd"))]
 pub(crate) fn setxattr(
     path: &CStr,
@@ -2637,6 +2677,33 @@ pub(crate) unsafe fn flistxattr(fd: BorrowedFd<'_>, list: (*mut u8, usize)) -> i
     }
 }
 
+#[cfg(linux_kernel)]
+pub(crate) unsafe fn listxattrat(
+    dirfd: BorrowedFd<'_>,
+    path: &CStr,
+    list: (*mut u8, usize),
+    flags: AtFlags,
+) -> io::Result<usize> {
+    const SYS_LISTXATTRAT: c::c_long = linux_raw_sys::general::__NR_listxattrat as c::c_long;
+    syscall! {
+        fn listxattrat_syscall(
+            base_dirfd: c::c_int,
+            path: *const ffi::c_char,
+            at_flags: c::c_uint,
+            list: *mut ffi::c_char,
+            size: usize
+        ) via SYS_LISTXATTRAT -> c::ssize_t
+    }
+
+    ret_usize(listxattrat_syscall(
+        borrowed_fd(dirfd),
+        c_str(path),
+        flags.bits(),
+        list.0.cast::<ffi::c_char>(),
+        list.1,
+    ))
+}
+
 #[cfg(any(apple, linux_kernel, target_os = "hurd"))]
 pub(crate) fn removexattr(path: &CStr, name: &CStr) -> io::Result<()> {
     #[cfg(not(apple))]

diff --git a/src/backend/linux_raw/fs/syscalls.rs b/src/backend/linux_raw/fs/syscalls.rs
@@ -41,8 +41,9 @@ use core::num::NonZeroU64;
 #[cfg(any(target_arch = "mips64", target_arch = "mips64r6"))]
 use linux_raw_sys::general::stat as linux_stat64;
 use linux_raw_sys::general::{
-    open_how, AT_EACCESS, AT_FDCWD, AT_REMOVEDIR, AT_SYMLINK_NOFOLLOW, F_ADD_SEALS, F_GETFL,
-    F_GET_SEALS, F_SETFL, SEEK_CUR, SEEK_DATA, SEEK_END, SEEK_HOLE, SEEK_SET, STATX__RESERVED,
+    open_how, xattr_args, AT_EACCESS, AT_FDCWD, AT_REMOVEDIR, AT_SYMLINK_NOFOLLOW, F_ADD_SEALS,
+    F_GETFL, F_GET_SEALS, F_SETFL, SEEK_CUR, SEEK_DATA, SEEK_END, SEEK_HOLE, SEEK_SET,
+    STATX__RESERVED,
 };
 #[cfg(target_pointer_width = "32")]
 use {
@@ -1575,6 +1576,40 @@ pub(crate) unsafe fn fgetxattr(
     ))
 }
 
+#[inline]
+pub(crate) unsafe fn getxattrat(
+    dirfd: BorrowedFd<'_>,
+    path: &CStr,
+    name: &CStr,
+    value: (*mut u8, usize),
+    flags: AtFlags,
+) -> io::Result<usize> {
+    let value_size = value.1.try_into().map_err(|_| io::Errno::OVERFLOW)?;
+    let value_addr = u64::try_from(value.0 as usize).map_err(|_| io::Errno::OVERFLOW)?;
+    let args = xattr_args {
+        value: value_addr,
+        size: value_size,
+        flags: 0,
+    };
+
+    let result = ret_usize(syscall!(
+        __NR_getxattrat,
+        dirfd,
+        path,
+        flags,
+        name,
+        by_ref(&args),
+        size_of::<xattr_args, _>()
+    ));
+
+    #[cfg(sanitize_memory)]
+    if let Ok(len) = result {
+        crate::msan::unpoison(value.0.cast(), len.min(value.1));
+    }
+
+    result
+}
+
 #[inline]
 pub(crate) fn setxattr(
     path: &CStr,
@@ -1650,6 +1685,30 @@ pub(crate) unsafe fn flistxattr(fd: BorrowedFd<'_>, list: (*mut u8, usize)) -> i
     ret_usize(syscall!(__NR_flistxattr, fd, list.0, pass_usize(list.1)))
 }
 
+#[inline]
+pub(crate) unsafe fn listxattrat(
+    dirfd: BorrowedFd<'_>,
+    path: &CStr,
+    list: (*mut u8, usize),
+    flags: AtFlags,
+) -> io::Result<usize> {
+    let result = ret_usize(syscall!(
+        __NR_listxattrat,
+        dirfd,
+        path,
+        flags,
+        list.0,
+        pass_usize(list.1)
+    ));
+
+    #[cfg(sanitize_memory)]
+    if let Ok(len) = result {
+        crate::msan::unpoison(list.0.cast(), len.min(list.1));
+    }
+
+    result
+}
+
 #[inline]
 pub(crate) fn removexattr(path: &CStr, name: &CStr) -> io::Result<()> {
     unsafe { ret(syscall_readonly!(__NR_removexattr, path, name)) }

diff --git a/src/fs/xattr.rs b/src/fs/xattr.rs
@@ -3,6 +3,8 @@
 #![allow(unsafe_code)]
 
 use crate::buffer::Buffer;
+#[cfg(linux_kernel)]
+use crate::fs::AtFlags;
 use crate::{backend, ffi, io, path};
 use backend::c;
 use backend::fd::AsFd;
@@ -100,6 +102,50 @@ pub fn fgetxattr<Fd: AsFd, Name: path::Arg, Buf: Buffer<u8>>(
     })
 }
 
+/// `getxattrat(dirfd, path, name, value, flags)`—Get extended filesystem
+/// attributes relative to an open directory.
+///
+/// `flags` may include [`AtFlags::SYMLINK_NOFOLLOW`] to operate on a symlink
+/// itself, or [`AtFlags::EMPTY_PATH`] to operate on `dirfd` when `path` is
+/// empty. Linux rejects [`AtFlags::EMPTY_PATH`] with [`io::Errno::BADF`] when
+/// `dirfd` is an `O_PATH` descriptor.
+///
+/// # Errors
+///
+/// This returns [`io::Errno::RANGE`] if the syscall reports a required length
+/// larger than the supplied buffer capacity, including a size-zero query for
+/// a nonempty value.
+///
+/// # References
+///  - [Linux]
+///
+/// [Linux]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/xattr.c?h=v6.13
+#[cfg(linux_kernel)]
+#[inline]
+pub fn getxattrat<Fd: AsFd, P: path::Arg, Name: path::Arg, Buf: Buffer<u8>>(
+    dirfd: Fd,
+    path: P,
+    name: Name,
+    mut value: Buf,
+    flags: AtFlags,
+) -> io::Result<Buf::Output> {
+    path.into_with_c_str(|path| {
+        name.into_with_c_str(|name| {
+            let value_parts = value.parts_mut();
+            let value_capacity = value_parts.1;
+            // SAFETY: `getxattrat` initializes the returned number of bytes.
+            let len = unsafe {
+                backend::fs::syscalls::getxattrat(dirfd.as_fd(), path, name, value_parts, flags)?
+            };
+            if len > value_capacity {
+                return Err(io::Errno::RANGE);
+            }
+            // SAFETY: `getxattrat` returned the number of initialized bytes.
+            unsafe { Ok(value.assume_init(len)) }
+        })
+    })
+}
+
 /// `setxattr(path, name, value.as_ptr(), value.len(), flags)`—Set extended
 /// filesystem attributes.
 ///
@@ -215,6 +261,46 @@ pub fn flistxattr<Fd: AsFd, Buf: Buffer<u8>>(fd: Fd, mut list: Buf) -> io::Resul
     unsafe { Ok(list.assume_init(len)) }
 }
 
+/// `listxattrat(dirfd, path, list, flags)`—List extended filesystem
+/// attributes relative to an open directory.
+///
+/// `flags` may include [`AtFlags::SYMLINK_NOFOLLOW`] to operate on a symlink
+/// itself, or [`AtFlags::EMPTY_PATH`] to operate on `dirfd` when `path` is
+/// empty. Linux rejects [`AtFlags::EMPTY_PATH`] with [`io::Errno::BADF`] when
+/// `dirfd` is an `O_PATH` descriptor.
+///
+/// # Errors
+///
+/// This returns [`io::Errno::RANGE`] if the syscall reports a required length
+/// larger than the supplied buffer capacity, including a size-zero query for
+/// a nonempty list.
+///
+/// # References
+///  - [Linux]
+///
+/// [Linux]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/xattr.c?h=v6.13
+#[cfg(linux_kernel)]
+#[inline]
+pub fn listxattrat<Fd: AsFd, P: path::Arg, Buf: Buffer<u8>>(
+    dirfd: Fd,
+    path: P,
+    mut list: Buf,
+    flags: AtFlags,
+) -> io::Result<Buf::Output> {
+    path.into_with_c_str(|path| {
+        let list_parts = list.parts_mut();
+        let list_capacity = list_parts.1;
+        // SAFETY: `listxattrat` initializes the returned number of bytes.
+        let len =
+            unsafe { backend::fs::syscalls::listxattrat(dirfd.as_fd(), path, list_parts, flags)? };
+        if len > list_capacity {
+            return Err(io::Errno::RANGE);
+        }
+        // SAFETY: `listxattrat` returned the number of initialized bytes.
+        unsafe { Ok(list.assume_init(len)) }
+    })
+}
+
 /// `removexattr(path, name)`—Remove an extended filesystem attribute.
 ///
 /// # References