aa_remove_profiles(9)

💅 aa_remove_profiles — bestie edition

okay so you're looking at aa_remove_profiles(9), and yes that's the kernel API manual, we're doing kernel internals today, stay with me 🫶

---

✨ NAME ✨

aa_remove_profiles — removes profile(s) from the system, no cap, they're gone

---

🦋 SYNOPSIS 🦋

ssize_t aa_remove_profiles (struct aa_ns *policy_ns , struct aa_label
*subj , char *fqname , size_t size );

that's the whole signature, character for character, don't come for me 💅

---

🎀 ARGUMENTS 🎀

• policy_ns — the namespace the remove is being done from. like, where the whole operation is happening ✨
• subj — the label that's attempting to remove policy. yes, this stuff is permission-gated, it's giving main character energy with a bouncer 👑
• fqname — the name of the profile or namespace to remove. and it is (NOT NULL) — not me being dramatic, that's literally in the manual, so do not pass NULL 🙈
• size — the size of the name. she needs to know how long it is, periodt

---

🌸 DESCRIPTION 🌸

so what actually happens? you remove a profile or a sub namespace from the current namespace — and once it's out, it can not be found anymore. literally unfindable. and it gets marked as replaced by unconfined.

that's the whole vibe check 🔥

---

💀 NOTE 💀

important caveat, bestie, do not skip this: removing confinement does not restore rlimits to preconfinement values. like, the rlimits stay where they are. no takebacks. that's just how it is 😭

---

⭐ RETURN ⭐

returns the size of data consume, or else an error code if it fails. that's it, that's the return, slay

---

🌈 SEE ALSO 🌈

kernel file ./security/apparmor/policy.c — and here's the whole friend group, all of them, in order, i'm not skipping a single one:

• aa_pdb_free_kref(9)
• __add_profile(9)
• __list_remove_profile(9)
• __remove_profile(9)
• __aa_profile_list_release(9)
• aa_free_data(9)
• aa_free_profile(9)
• aa_alloc_profile(9)
• __strn_find_child(9)
• __find_child(9)
• aa_find_child(9)
• __lookup_parent(9)
• __create_missing_ancestors(9)
• __lookupn_profile(9)
• aa_lookupn_profile(9)
• __aa_new_learning_profile(9)
• replacement_allowed(9)
• audit_policy(9)
• aa_policy_view_capable(9)
• aa_may_manage_policy(9)
• __replace_profile(9)
• __lookup_replace(9)
• aa_replace_profiles(9)

iykyk 🧚💜

---

aaaand that's the page! this little gem lives in ./security/apparmor and the version/date stamped on it is October 2026 — so yeah, future-coded icon behavior ⭐🎀 go forth and remove profiles responsibly, mwah 💖