AA_QUERY_LABEL(2)

💖 AA_QUERY_LABEL(2) 💖

okay bestie, so this is the AppArmor page all about aa_query_label and its little helper squad — aa_query_file_path, aa_query_file_path_len, aa_query_link_path and aa_query_link_path_len. yes, that's a lot of names, but they're all doing the same vibe: asking the kernel "hey, is this allowed?" 🫶

---

✨ NAME ✨

• aa_query_label — query access permission associated with a label
• aa_query_file_path, aa_query_file_path_len — query access permissions of a file path
• aa_query_link_path, aa_query_link_path_len — query access permissions of a link path

---

🌸 SYNOPSIS 🌸

#include <sys/apparmor.h>

int aa_query_label(uint32_t mask, char *query, size_t size, int
*allowed, int *audited);

int aa_query_file_path(uint32_t mask, const char *label, size_t
label_len, const char *path, int *allowed, int *audited);

int aa_query_file_path_len(uint32_t mask, const char *label, size_t
label_len, const char *path, size_t path_len, int *allowed, int
*audited);

int aa_query_link_path(const char *label, const char *target, const char
*link, int *allowed, int *audited);

int aa_query_link_path_len(const char *label, size_t label_len, const
char *target, size_t target_len, const char *link, size_t link_len, int
*allowed, int *audited);

and like, don't forget to link with -lapparmor when compiling, or the whole thing just will not hit 💅

---

🦋 DESCRIPTION 🦋

so aa_query_label goes and fetches the current permissions granted by the label you stuffed into the query string. it's giving "asking the vibes what's allowed rn" ✨

the query is a raw binary formatted query, and it's carrying the label plus the permission query you wanna make. the allowed and audited values that come back are interpreted boolean values — literally just telling you whether the query is allowed, and whether it's audited. no drama, no extra lore 💖

the mask of the query string is a bit mask of permissions to query, and it's class type dependent (peep the AA_CLASS_xxx entries in sys/apparmor.h, iykyk).

the format of the query string is also dependent on the AA_CLASS, which is exactly why the aa_query_xxx helper functions should usually be used instead of raw-dogging aa_query_label directly. if you do go straight at the interface, the query string is required to have a header of AA_QUERY_CMD_LABEL_SIZE that will be used by aa_query_label. not optional, bestie, that's the rule 🎀

aa_query_file_path and aa_query_file_path_len are helper functions that assemble a properly formatted file path query for aa_query_label to eat. the label is a valid apparmor label as returned by aa_splitcon, with label_len being the length of the label. the path is any valid filesystem path you wanna query permissions for. and for the aa_query_file_path_len variant, the path_len parameter specifies the number of bytes in the path to use as part of the query. slay 💅

aa_query_link_path and aa_query_link_path_len are helper functions that assemble a properly formatted link path query for aa_query_label. the link_len and target_len parameters specify the number of bytes in the link and target to use as part of the query. icon behavior honestly 👑

---

🌈 RETURN VALUE 🌈

on success, 0 is returned, and the allowed and audited parameters contain a boolean value of 0 for not allowed/audited or 1 for allowed/audited. easy. on error, -1 is returned, and errno(3) is set appropriately. the way that error handling just works 😭

---

💀 ERRORS 💀

• EINVAL
  • the requested mask is empty.
  • the size of the query is less than the query AA_QUERY_CMD_LABEL_SIZE
  • the apparmor kernel module is not loaded, or the kernel interface access interface is not available
• ENOMEM — insufficient memory was available. rough. 🙈
• EACCES — access to the specified label or query interface was denied. big L, but okay.
• ENOENT — the specified label does not exist or is not visible.
• ERANGE — the confinement data is too large to fit in the supplied buffer. it's giving "cannot fit, bestie" 🍓

---

⭐ NOTES ⭐

the label permissions returned are only valid for the time of the query and can change at any point in the future. so like... screenshot it, because it's not staying the same 🫶

---

🧚 BUGS 🧚

none known. if you find any, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>. be a main character and file that bug report ✨

---

👑 SEE ALSO 👑

apparmor(7), apparmor.d(5), apparmor_parser(8), aa_getcon(2), aa_splitcon(3) and <https://wiki.apparmor.net>.

---

and that's the page, bestie! mwah 💖✨ — courtesy of AppArmor 4.1.8, dated 2026-10-18, and this whole manual thing was AA_QUERY_LABEL(2). go query some labels, periodt 🌸