AA_FIND_MOUNTPOINT(2)

💅 AA_FIND_MOUNTPOINT(2) — the AppArmor girlies' guide ✨

okay so this is a page from the AppArmor manual, section 2 (that's the syscalls/libc functions girlies, iykyk), and it's all about two lil functions: aa_is_enabled and aa_find_mountpoint. yes bestie, both of them live here, we're sharing a page, it's giving roommate energy 🫶

🌸 NAME 🌸

aa_is_enabled — literally just tells you if AppArmor is available. vibe check for the kernel.
aa_find_mountpoint — finds where the AppArmor interface filesystem is mounted. like a Where's Waldo but the Waldo is a mount path 🦋

✨ SYNOPSIS ✨

#include <sys/apparmor.h>

int aa_is_enabled(void);

int aa_find_mountpoint(char **mnt);

and listen, when you compile, you gotta link with -lapparmor. no cap, that's non-negotiable 💅

💖 DESCRIPTION 💖

so, the aa_is_enabled function returns true (that's 1, bestie — 1!) if AppArmor is enabled. and if it isn't enabled? it sets the errno(3) to reflect the reason it's not enabled and returns 0. so you get the why, which is honestly so thoughtful of it 🥹

and the aa_find_mountpoint function finds where the AppArmor filesystem is mounted on the system, and returns a string containing the mount path. but — and this is the part where you gotta pay attention — it is the caller's responsibility to free(3) the returned path. that memory is yours now. you asked for it, you clean it up. main character responsibility 🔥

🌈 RETURN VALUE 🌈

aa_is_enabled — on success, 1 is returned. slay. on error, 0 is returned, and the errno(3) is set appropriately.

aa_find_mountpoint — on success, zero is returned. on error, -1 is returned, and the errno(3) is set appropriately.

not me keeping track of which one returns 1/0 and which one returns 0/-1 — they're different, bestie, don't mix them up 😭

🎀 ERRORS 🎀

👑 `aa_is_enabled`

ENOSYS — the AppArmor extensions to the system are not available. it's not here. she's not coming. 💀
ECANCELED — AppArmor is available on the system but has been disabled at boot. so close and yet so far 🥲
EBUSY — AppArmor is available but only via private interfaces. lowkey available, highkey not really.
ENOENT — AppArmor is available (and maybe even enforcing policy) but the interface is not available. the girl is employed but not answering her phone 📵
ENOMEM — insufficient memory was available. the system is broke, respectfully.
EPERM — did not have sufficient permissions to determine if AppArmor is enabled. you don't have the pass ✋
EACCES — did not have sufficient permissions to determine if AppArmor is enabled. same energy, different errno, periodt.
EBUSY — AppArmor is enabled but does not have access to shared interfaces, and only private interfaces are available. yes this is the second EBUSY on the list and no we're not going to question it, it's just built different 💅