aa_dfa_unpack(9)

aa_dfa_unpack 🧚

okay so bestie, this is aa_dfa_unpack from the Kernel API Manual, and it's literally the moment a serialized dfa gets unpacked. ✨

NAME 🌸

aa_dfa_unpack — unpack the binary tables of a serialized dfa

SYNOPSIS 🎀

struct aa_dfa * aa_dfa_unpack (const void *blob , size_t size , int flags );

ARGUMENTS 💅

• blob — aligned serialized stream of data to unpack (NOT NULL). no cap, this one is required.
• size — size of data to unpack.
• flags — flags controlling what type of accept tables are acceptable.

DESCRIPTION 🦋

Unpack a dfa that has been serialized. For the tea on the dfa format, look in Documentation/admin-guide/LSM/apparmor.rst.

Tiny but important vibe check: it assumes the dfa blob stream has been aligned on a 8 byte boundary.

RETURN 🔥

an unpacked dfa ready for matching or ERR_PTR on failure. That's the whole mood: either you get the matching-ready dfa, or ERR_PTR if it flops.

SEE ALSO 👑

Kernel file ./security/apparmor/match.c, plus these iconically linked functions:

• unpack_table(9)
• verify_table_headers(9)
• verify_dfa(9)
• dfa_free(9)
• aa_dfa_free_kref(9)
• remap_data16_to_data32(9)
• aa_dfa_match_len(9)
• aa_dfa_match(9)
• aa_dfa_next(9)
• aa_dfa_match_until(9)
• aa_dfa_matchn_until(9)
• aa_dfa_leftmatch(9)

💖 that's the page, bestie — brought to you from ./security/apparmor, dated October 2026, for the aa_dfa_unpack(9) manual. 🫶