aa_path_link(9)

💅 aa_path_link(9) — from the Kernel API Manual, bestie

Okay so this page is aa_path_link(9) and it lives in the Kernel API Manual, and honestly? It's lowkey iconic. Let's get into it. 🦋

---

✨ NAME ✨

aa_path_link — the one that handles the hard link permission check. That's it, that's the whole vibe. 🎀

---

🌸 SYNOPSIS 🌸

int aa_path_link (const struct cred *subj_cred , struct aa_label *label
, struct dentry *old_dentry , const struct path *new_dir , struct dentry
*new_dentry );

That's the whole signature, character for character — don't come for me, I copied it exactly. 💜

---

🫶 ARGUMENTS 🫶

Bestie, here's who's who in this function's little friend group:

• subj_cred — the subject cred. Like, the credentials of whoever's doing the thing. 💳
• label — the label being enforced. This one is NOT NULL, no exceptions, so don't even try it. 🙈
• old_dentry — the target dentry. Also NOT NULL. The thing being pointed at. 🎯
• new_dir — the directory the new link will be created in. NOT NULL again, the girlies love a constraint. 📁
• new_dentry — the link being created. And yes — NOT NULL. 🎀

---

🔥 DESCRIPTION 🔥

So what she actually does: she handles the permission test for a link & target pair. That's the whole assignment. 💅

Permission is encoded as a pair. The way it works is: the link permission is determined first, and then — only if that's allowed — the target gets tested. No skipping ahead, no cutting the line. ✨

And here's the spicy bit that makes her different: the target test is done from the point of the link match (not the start of the DFA). Which means the target permission is literally dependent on the link permission match. It's giving main-character link permission, honestly. 👑

There's also the subset test, if it's required — that one forces the permissions granted on the link to be a subset of the permissions granted to the target. Like, the link can't have more than the target. Periodt. 🌈

---

⭐ RETURN ⭐

0 if it's allowed — slay, we love a zero. Otherwise? An error. 😭

---

🧚 SEE ALSO 🧚

Go read these next, iykyk — all from the kernel file ./security/apparmor/file.c: file_audit_cb(9), aa_audit_file(9), aa_lookup_condperms(9), aa_str_perms(9), aa_path_perm(9), xindex_is_subset(9), aa_file_perm(9). 💖

---

ngl, if you skipped the "NOT NULL" notes, go back — they were there for a reason. 🫶

---

Okay that's the whole page!! Coming to you from ./security/apparmor, dated October 2026 — mwah, hope this helped bestie, go be iconic with your hard links 💅💖✨