ZwSetEaFile function (ntifs.h)

Article
04/26/2024

ZwSetEaFile replaces the extended attributes (EAs) associated with a file with the specified EAs.

Syntax

NTSTATUS ZwSetEaFile(
  [in]  HANDLE           FileHandle,
  [out] PIO_STATUS_BLOCK IoStatusBlock,
  [in]  PVOID            Buffer,
  [in]  ULONG            Length
);

Parameters

[in] FileHandle

The handle for the file on which the operation is to be performed.

[out] IoStatusBlock

A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and other information about the requested operation.

[in] Buffer

A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured input buffer that contains the new EAs that will replace the EAs currently associated with the file.

[in] Length

Length, in bytes, of the buffer that the Buffer parameter points to.

Return value

ZwSetEaFile returns STATUS_SUCCESS or an appropriate NTSTATUS value such as the following:

Return value	Description
STATUS_EA_LIST_INCONSISTENT	The EA list that Buffer points to isn't formatted correctly. This is an error code.
STATUS_INSUFFICIENT_RESOURCES	There isn't enough memory available to complete the operation. This is an error code.

Remarks

ZwSetEaFile replaces the EAs associated with FileHandle with the EAs in the buffer that Buffer points to. The EAs in the buffer must be formatted as a sequence of FILE_FULL_EA_INFORMATION structures. ZwSetEaFile first checks that the buffer of EA values is valid before replacing the existing EAs.

Requirements

Requirement	Value
Minimum supported client	Windows 2000
Target Platform	Universal
Header	ntifs.h (include FltKernel.h, Ntifs.h)
Library	NtosKrnl.lib
DLL	NtosKrnl.exe
IRQL	PASSIVE_LEVEL
DDI compliance rules	HwStorPortProhibitedDDIs(storport), PowerIrpDDis(wdm)