diff --git a/bin/daemon.rs b/bin/daemon.rs
index 6cbea2debddb52530fab0f47048055f536eca5ef..a0a0350a5952b69d54fa5020d6475de9a5e3fdc7 100644
--- a/bin/daemon.rs
+++ b/bin/daemon.rs
@@ -283,10 +283,14 @@ fn bolt_optimize_so(conf: &RtoConfig) -> i32 {
 
 pub fn set_app_aot_flag(old_path: &String, is_set: bool) -> i32 {
 	let mut args: Vec<String> = Vec::new();
+	let setfattr = "setfattr".to_string();
+	args.push("-n".to_string());
+	args.push("trusted.sysboost_flags".to_string());
+	args.push("-v".to_string());
 	if is_set {
-		args.push("--set".to_string());
+		args.push("true".to_string());
 	} else {
-		args.push("--unset".to_string());
+		args.push("false".to_string());
 	}
 	let old_path = Path::new(old_path);
 	let old_path = match fs::canonicalize(old_path) {
@@ -305,7 +309,7 @@ pub fn set_app_aot_flag(old_path: &String, is_set: bool) -> i32 {
 		}
 	}
 	args.push(new_path.to_str().unwrap().to_string());
-	let ret = run_child(SYSBOOST_PATH, &args);
+	let ret = run_child(&setfattr, &args);
 	match fs::rename(&new_path, &old_path) {
 		Ok(_) => {}
 		Err(e) => {
diff --git a/src/binfmt_rto/binfmt_rto.c b/src/binfmt_rto/binfmt_rto.c
index 2c4f9cfb3f787e547b7f16eb43b793631307fc5e..e4a8ee8e73f10367e25ad045beef1833a2a34c10 100644
--- a/src/binfmt_rto/binfmt_rto.c
+++ b/src/binfmt_rto/binfmt_rto.c
@@ -46,6 +46,9 @@
 #include <linux/cred.h>
 #include <linux/dax.h>
 #include <linux/uaccess.h>
+#include <linux/xattr.h>
+#include <linux/dcache.h>
+
 #include <asm/param.h>
 #include <asm/page.h>
 
@@ -1179,6 +1182,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
 	struct mm_struct *mm;
 	struct pt_regs *regs;
+	struct dentry *elf_dentry = (struct dentry *)bprm->file->f_path.dentry;
+	struct inode *elf_inode = (struct inode *)elf_dentry->d_inode;
+	struct xattr *xattr = NULL;
+	int xattr_size = 0;
 
 #ifdef CONFIG_ELF_SYSBOOST
 	bool is_rto_format = false;
@@ -1211,8 +1218,22 @@ load_rto:
 		goto out;
 
 #ifdef CONFIG_ELF_SYSBOOST
+	// try to get attr from bprm
+	xattr_size = elf_inode->i_op->getattr(elf_dentry, "trusted.flags", xattr, 0);
+	if (xattr_size > 0) {
+		xattr = kmalloc(xattr_size + 1, GFP_KERNEL);
+		if (!xattr) {
+			retval = -ENOMEM;
+			goto out;
+		}
+		xattr_size = elf_inode->i_op->getattr(elf_dentry, "trusted.flags", xattr, xattr_size);
+		if (xattr_size < 0) {
+			retval = -ENOMEM;
+			goto out;
+		}
+	}
 	/* replace app.rto file, then use binfmt */
-	if (elf_ex->e_flags & OS_SPECIFIC_FLAG_SYMBOLIC_LINK) {
+	if (!memcmp(xattr, "true", xattr_size)) {
 		int ret = try_replace_file(bprm);
 		if (!ret) {
 			if (elf_ex->e_flags & OS_SPECIFIC_FLAG_RTO) {