AA_GETCON(2)

💅 AA_GETCON(2) — the AppArmor family 💅

okay so bestie, this is the whole AppArmor "get confinement" squad, all in one page. it's AA_GETCON(2) from the AppArmor manual, and it's lowkey the most useful thing ever if you want to know what profile a task is living under. let's go 🫶

---

✨ NAME ✨

aa_getprocattr_raw, aa_getprocattr — read and parse procattr data 📖

aa_getcon, aa_gettaskcon — get task confinement information 🕵️‍♀️

aa_getpeercon — get the confinement of a socket's other end (peer) 🔌

---

🌸 SYNOPSIS 🌸

#include <sys/apparmor.h>

int aa_getprocattr_raw(pid_t tid, const char *attr, char *buf, int len,
char **mode);

int aa_getprocattr(pid_t tid, const char *attr, char **label, char
**mode);

int aa_gettaskcon(pid_t target, char **label, char **mode);

int aa_getcon(char **label, char **mode);

int aa_getpeercon_raw(int fd, char *buf, int *len, char **mode);

int aa_getpeercon(int fd, char **label, char **mode);

and when you compile, you gotta link with -lapparmor — no cap, don't forget her 🔗

---

🦋 DESCRIPTION 🦋

so aa_getcon gets the current AppArmor confinement context for the current task. it's giving main character energy: it just looks at itself. ✨

the confinement context is two things: a label and a mode.

• the label is usually just the name of the AppArmor profile restricting the task — but bestie, it can also include the profile namespace, or in some cases a whole set of profile names (that's called a stack of profiles 👑).
• the mode is a string describing how the kernel is enforcing the policy defined in the profile.

how do the modes work? glad you asked 💅

• profiles loaded in "enforce" mode will result in enforcement of the policy defined in the profile, and they report policy violation attempts.
• profiles in "complain" mode will not enforce policy — they just report policy violation attempts. it's the "I'm just gonna tell you about it" era.

some examples of possible returned *label strings are "unconfined", "/sbin/dhclient", and "Firefox". the string can consist of any non-NUL characters, but it will be NUL-terminated. the *label string must be freed using free(). 🧹

the possible *mode strings are "enforce" and "complain". additionally, *mode may be NULL when *label is "unconfined". the *mode string must not be freed — hands off, she's not yours 🙈. the *label and *mode strings come from a single buffer allocation and are separated by a NUL character.

aa_gettaskcon is like aa_getcon, except it will work for any arbitrary task in the system. so you can peek at literally anyone. respect. 🌈

aa_getpeercon is similar to aa_gettaskcon, except that it returns the confinement information for the task on the other end of a socket connection. it's giving "who even are you" energy. 🔌

aa_getpeercon_raw is the backend for aa_getpeercon and does not handle buffer allocation. you're on your own for the buffer, bestie 💀

aa_getprocattr is the backend for aa_getcon and aa_gettaskcon. it handles the reading and parsing of the confinement data from different arbitrary attr files, and returns the processed results in an allocated buffer. she does all the work fr fr 🎀

aa_getprocattr_raw() is the backend for aa_getprocattr and does not handle buffer allocation. again: your buffer, your problem. 🙈

---

⭐ RETURN VALUE ⭐

on success, the size of data placed in the buffer is returned — and yes, that includes the mode if present, plus any terminating characters. 🎉

on error, -1 is returned, and errno(3) is set appropriately. it's giving "something went wrong and here's the receipt." 😭

---

🔥 ERRORS 🔥

• EINVAL — the apparmor kernel module is not loaded, or the communication via the /proc/*/attr/file did not conform to protocol. 🚫
• ENOMEM — insufficient kernel memory was available. she's out of room 💀
• EACCES — access to the specified file/task was denied. no entry, bestie 🚪
• ENOENT — the specified file/task does not exist or is not visible. she's not even there 👻
• ERANGE — the confinement data is too large to fit in the supplied buffer. your buffer is too small, it's giving snack-size 🍓
• ENOPROTOOPT — the kernel doesn't support the SO_PEERLABEL option in sockets. this happens mainly when the kernel lacks 'fine grained unix mediation' support. it also can happen on LSM stacking kernels where another LSM has claimed this interface and decides to return this error — although this is really a corner case. 🫠

---

🧚 NOTES 🧚

if aa_getpeercon_raw returns -1 and errno is ERANGE, the value of *len can be used to reallocate buf so that it is sufficiently large enough to store the confinement data. so like… she told you how big she needs to be. use that info. 💡

---

💜 BUGS 💜

none known. if you find any, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>. do it for the girls 🫶 (ngl, if you find one, you're kinda iconic for it 👑)

---

🎀 SEE ALSO 🎀

apparmor(7), apparmor.d(5), apparmor_parser(8), aa_change_profile(2), aa_splitcon(3) and <https://wiki.apparmor.net>. go read them, iykyk 📚✨

---

and that's the whole vibe, bestie — this page is from AppArmor 4.1.8, dated 2026-10-18. slay, go get yourself some confinement info 💅💖