__lookup_parent(9)

💅 __lookup_parent(9) — the Kernel API Manual tea ☕✨

okay bestie, so we're in the Kernel API Manual today, and honestly? this one's a little cutie. sit down, grab a strawberry 🍓, and let's talk about finding a profile's parent. yes, like a parent. family drama in the AppArmor namespace, iykyk.

---

✨ NAME ✨

__lookup_parent — lookup the parent of a profile of name @hname 💖

---

🦋 SYNOPSIS 🦋

struct aa_policy * __lookup_parent (struct aa_ns *ns , const char *hname
);

---

🎀 ARGUMENTS 🎀

• ns — the namespace you're doing the lookup in. this one is NOT NULL, no cap, do not pass NULL, we will not be entertaining that 🙈
• hname — the hierarchical profile name, and we're finding the parent of it. also NOT NULL. same rule, bestie 🫶

---

🌸 DESCRIPTION 🌸

so what this does is it looks up the parent of a fully qualified profile name. and here's the iconic part: the profile that matches hname does not need to exist. literally doesn't have to be there. it's giving "we're finding your mom even though you haven't been born yet" 😭

in general, this is used to load a new profile. that's the whole vibe. new profile energy, main character energy, finding where it belongs in the tree energy 👑

Requires: rcu_read_lock be held. like, actually. hold it. do not skip this. this is the one thing you cannot flake on 🔥

---

⭐ RETURN ⭐

you get back an unrefcounted policy — or NULL if it's not found. note the unrefcounted part, that's important, don't come crying to me later about refcounts 💀

---

🧚 SEE ALSO 🧚

• Kernel file ./security/apparmor/policy.c
• aa_pdb_free_kref(9)
• __add_profile(9)
• __list_remove_profile(9)
• __remove_profile(9)
• __aa_profile_list_release(9)
• aa_free_data(9)
• aa_free_profile(9)
• aa_alloc_profile(9)
• __strn_find_child(9)
• __find_child(9)
• aa_find_child(9)
• __create_missing_ancestors(9)
• __lookupn_profile(9)
• aa_lookupn_profile(9)
• __aa_new_learning_profile(9)
• replacement_allowed(9)
• audit_policy(9)
• aa_policy_view_capable(9)
• aa_may_manage_policy(9)
• __replace_profile(9)
• __lookup_replace(9)
• aa_replace_profiles(9)
• aa_remove_profiles(9)

like, that's the whole friend group right there. go say hi 👋

---

and that's the page, bestie!! 🎀 this lil gem lives over in ./security/apparmor, dated October 2026, and it's page __lookup_parent(9) of the Kernel API Manual. slay, go hold that rcu_read_lock 💜✨