Changing the file’s creation timestamp in Linux programmatically in C/C++

The statx() system call was added to Linux kernel and now it is possible to get the creation (birth) time of the file from statx.stx_btime stucture field on supported filesystems. But I can’t find any support in utimensat() of similar system calls.

Is it possible to change file’s creation timestamp in C/C++ and how?

Answer

statx.stx_btime is filesystem-specific. Linux has only three standardized timestamps – ctime, atime, and mtime – which are filled by the filesystem-agnostic generic_fillattr function.

Creation time on the other hand is filled by filesystem-specific functions, for instance with ext4 you can see the relevant code here:

int ext4_getattr(struct user_namespace *mnt_userns, const struct path *path,
         struct kstat *stat, u32 request_mask, unsigned int query_flags)
{
    struct inode *inode = d_inode(path->dentry);
    struct ext4_inode *raw_inode;
    struct ext4_inode_info *ei = EXT4_I(inode);
    unsigned int flags;

    if ((request_mask & STATX_BTIME) &&
        EXT4_FITS_IN_INODE(raw_inode, ei, i_crtime)) {
        stat->result_mask |= STATX_BTIME;
        stat->btime.tv_sec = ei->i_crtime.tv_sec;
        stat->btime.tv_nsec = ei->i_crtime.tv_nsec;
    }
...

There seems to be no easy way to access the creation time – a quick search reveals that ext4’s i_crtime is not directly modifiable.

A possible solution is to write a filesystem-specific driver to modify e.g. i_crtime directly – but this carries its own risks in modifying internal filesystem data.