aa_check_perms(9)

okay bestie, welcome to aa_check_perms(9) — this one lives in the Kernel API Manual, and it's literally the function that does audit mode selection based on the perms set. 💅

💖 NAME 💖

aa_check_perms — do audit mode selection based on perms set

✨ SYNOPSIS ✨

int aa_check_perms (struct aa_profile *profile , const struct aa_perms *perms , u32 request , struct apparmor_audit_data *ad , void (*cb)(struct audit_buffer *, void *) );

🫶 ARGUMENTS 🫶

• profile — the profile being checked 👑
• perms — perms computed for the request 🎀
• request — requested perms ✨
• ad — initialized audit structure (MAY BE NULL if not auditing) 🙈
• cb — callback fn for type specific fields (MAY BE NULL) 🦋

🎀 RETURN 🎀

0 if permission, else error code. periodt. 💯

💅 NOTE 💅

profile audit modes need to be set before calling by setting the perm masks appropriately. no cap, that's the setup vibe. 🧚

If not auditing then complain mode is not enabled and the error code will indicate whether there was an explicit deny with a positive value. so yeah, the error code is giving you the tea. ☕

🌈 SEE ALSO 🌈

• Kernel file ./security/apparmor/lib.c
• val_mask_to_str(9)
• aa_destroy_str_table(9)
• skipn_spaces(9)
• aa_info_message(9)
• aa_perm_mask_to_str(9)
• aa_apply_modes_to_perms(9)
• aa_policy_init(9)
• aa_policy_destroy(9)

This page made its way to you from ./security/apparmor, dated October 2026, and it's the aa_check_perms(9) manual page. bye bestie, ily 💖🫶