aa_xattrs_match(9)

💖 NAME 💖

okay so this is aa_xattrs_match(9), straight outta the Kernel API Manual 💅 and it does exactly what the name says: it checks whether a file matches the xattrs defined in profile. slay.

✨ SYNOPSIS ✨

int aa_xattrs_match (const struct path *path , const struct aa_profile
       *profile , aa_state_t state );

🎀 ARGUMENTS 🎀

• path — path for file being matched (NOT NULL) 🫶 like bestie this one literally cannot be NULL, fr fr
• profile — profile to match against (NOT NULL) 👑 again, NOT NULL, no cap
• state — state to start match in 🌸

🌈 RETURN 🌈

it returns the number of extended attributes that matched ✨ or < 0 on error 💀 so if you see a negative number, that's not a count, that's the error vibe check failing 😭

🦋 SEE ALSO 🦋

go peek at these icons 👑 the kernel file ./security/apparmor/domain.c is in the mix too:

• may_change_ptraced_domain(9)
• label_compound_match(9)
• label_components_match(9)
• label_match(9)
• change_profile_perms(9)
• find_attach(9)
• x_table_lookup(9)
• x_to_label(9)
• apparmor_bprm_creds_for_exec(9)
• aa_change_hat(9)
• aa_change_profile(9)

mwah 💋 source/version: ./security/apparmor; date: October 2026; and yeah bestie, this is the aa_xattrs_match(9) page. byeee 🫶