aa_change_hat(9)

okay bestie, welcome to aa_change_hat(9) from the Kernel API Manual — we're doing a whole hat-change-to/from-subprofile moment, and yes the manual name is literally right there in the function name, iykyk 💅✨

🎀 NAME 🎀

aa_change_hat — change hat to/from subprofile. That's the whole vibe: it's the function that flips your hat to/from a subprofile, periodt 🫶

🦋 SYNOPSIS 🦋

int aa_change_hat (const char *hats[] , int count , u64 token , int
flags );

✨ ARGUMENTS ✨

• hats — vector of hat names to try changing into (MAYBE NULL if count == 0) — yes, all caps, that's the actual note 🙈
• count — number of hat names in hats — the whole count, bestie 🔢
• token — magic value to validate the hat change — magic value, literally ✨
• flags — flags affecting behavior of the change — flags doing flag things, highkey important 🚩

🔥 DESCRIPTION 🔥

Returns 0 on success, error otherwise. That's the contract, bestie — 0 is the slay, anything else is the error vibe 😭

Change to the first profile specified in hats that exists, and store the hat_magic in the current task context. If the count == 0 and the token matches that stored in the current task context, return to the top level profile. Iconic behavior, honestly. ✨

change_hat only applies to profiles in the current ns, and each profile in the ns must make the same transition otherwise change_hat will fail. No cap, that same-transition rule is not optional. 💀

🌈 SEE ALSO 🌈

Kernel file ./security/apparmor/domain.c may_change_ptraced_domain(9), label_compound_match(9), label_components_match(9), label_match(9), change_profile_perms(9), aa_xattrs_match(9), find_attach(9), x_table_lookup(9), x_to_label(9), apparmor_bprm_creds_for_exec(9), aa_change_profile(9) — a whole friend group of references, go read them if you're nosy 🫶

mwah 💋 — this page comes from ./security/apparmor, dated October 2026, and it's all about aa_change_hat(9). byeee 🎀🦋