__lookup_replace(9)

okay so we're in the Kernel API Manual, and today's main character is __lookup_replace(9) 💅✨. She's here to look up replacement info for a profile, and honestly? iconic.

🎀 NAME 🎀

__lookup_replace — lookup replacement information for a profile. That's the whole gig, bestie. 🦋

✨ SYNOPSIS ✨

The signature is giving “kernel function with a whole lot of pointers”, and not me keeping it exactly as-is, fr fr:

       int __lookup_replace (struct aa_ns *ns , const char *hname , bool
       noreplace , struct aa_profile **p , const char **info );

💖 ARGUMENTS 💖

okay so the friend group here is:

• ns — namespace the lookup occurs in. Like, where the whole thing is happening 💫
• hname — name of profile to lookup. yes, the profile name, bestie.
• noreplace — true if not replacing an existing profile. lowkey important vibe check.
• p — Returns - profile to be replaced. that's the output pointer, periodt.
• info — Returns - info string on why lookup failed. so if it flops, this tells you why 😭

🔥 RETURN 🔥

On success: profile to replace (no ref) — literally no ref, bestie. Otherwise: ptr error. no cap, that's the return vibe.

🌈 SEE ALSO 🌈

Kernel file ./security/apparmor/policy.c — and the whole SEE ALSO friend group is right here, no one left out:

• aa_pdb_free_kref(9)
• __add_profile(9)
• __list_remove_profile(9)
• __remove_profile(9)
• __aa_profile_list_release(9)
• aa_free_data(9)
• aa_free_profile(9)
• aa_alloc_profile(9)
• __strn_find_child(9)
• __find_child(9)
• aa_find_child(9)
• __lookup_parent(9)
• __create_missing_ancestors(9)
• __lookupn_profile(9)
• aa_lookupn_profile(9)
• __aa_new_learning_profile(9)
• replacement_allowed(9)
• audit_policy(9)
• aa_policy_view_capable(9)
• aa_may_manage_policy(9)
• __replace_profile(9)
• aa_replace_profiles(9)
• aa_remove_profiles(9)

Source/version: ./security/apparmor · date: October 2026 · manual: __lookup_replace(9) — k bye bestie, mwah 💋🎀