aa_capable(9)

💅 aa_capable(9) — like, the Kernel API Manual era 🎀

okay bestie, gather round, because we're looking at aa_capable from the Kernel API Manual and honestly? she's a little legend. the whole girlboss job here is testing permission to use a capability. that's it, that's the vibe check ✨

---

🌸 SYNOPSIS 🌸

int aa_capable (const struct cred *subj_cred , struct aa_label *label ,
int cap , unsigned int opts );

no cap, that's the whole signature. read it, love it, memorize it 🫶

---

🦋 ARGUMENTS 🦋

• subj_cred — the cred we're testing the capability against, iykyk 💖
• label — the label being tested for the capability. and listen: this one is NOT NULL, so don't even try it 🙈
• cap — the actual capability being tested, the main character of this whole operation 👑
• opts — it's giving options. specifically, the CAP_OPT_NOAUDIT bit decides whether an audit record gets generated or not 🔥

---

💜 DESCRIPTION 💜

so what does she do? she looks up the capability in the profile capability set. literally that's it. cute, efficient, slay ⭐

---

🌈 RETURN 🌈

0 on success — periodt 💅

or else an error code, which, when it happens, is lowkey devastating but we move 😭

---

🧚 SEE ALSO 🧚

• Kernel file ./security/apparmor/capability.c
• audit_cb(9)
• audit_caps(9)
• profile_capable(9)

all of these are your besties too, go say hi 💖

---

ok but fr fr, remember label is NOT NULL and opts' CAP_OPT_NOAUDIT bit is the whole audit-or-no-audit situation. don't forget, bestie 🫶

---

and that's the page! brought to you by ./security/apparmor in October 2026, aa_capable(9) era — stay iconic, drink water, and may all your capabilities return 0 🌸💜✨