apparmor_sock_graft(9)

💅 apparmor_sock_graft — a kernel API manual, bestie edition 🎀

okay so real talk, this is section 9 of the Kernel API Manual (apparmor_sock_graft(9), if you're keeping track, which you are, because you're iconic like that ✨). It's a tiny little function with a big job, and we're gonna get into it.

---

✨ NAME ✨

apparmor_sock_graft — initializes a newly created socket 🌱

like, fresh-out-the-box socket energy. brand new. no cap. 🫶

---

🌸 SYNOPSIS 🌸

void apparmor_sock_graft (struct sock *sk , struct socket *parent );

that's it. that's the whole signature. short, sweet, returns void — so it does stuff, it just doesn't gossip about it back to you 💅

---

🦋 ARGUMENTS 🦋

• sk — the child sock 👶 the new baby, the main character of this operation ngl
• parent — the parent socket 👑 the one that brought the child sock into this world, and whose context might come up later (see the note, bestie 👀)

---

🎀 NOTE 🎀

okay so this is the part where I hold your hand, because there's lore here 🫶

could set off of SOCK_CTX(parent) but need to track inode and we can just set sk security information off of current creating process label — so it could be based on SOCK_CTX(parent), but there's this whole inode-tracking situation, and honestly we can just set the sk security information off of the current creating process's label. simple. done. slay. ✨

Labeling of sk for the accept case — probably should be sock based instead of task, because of the case where an implicitly labeled socket is shared by different tasks. 🫠 like, imagine one implicitly labeled socket being passed between different tasks — yeah, that's exactly why the accept case probably wants to be sock based instead of task based. it's giving "we know, it's on the list" energy fr fr.

no behaviour changes are being promised here, bestie — these are design notes from the source, not me inventing anything 🙈

---

🌈 SEE ALSO 🌈

the whole friend group 💜 — Kernel file ./security/apparmor/lsm.c plus all of these:

• common_perm(9)
• common_perm_cond(9)
• common_perm_dir_dentry(9)
• common_perm_rm(9)
• common_perm_create(9)
• apparmor_uring_override_creds(9)
• apparmor_uring_sqpoll(9)
• apparmor_bprm_committing_creds(9)
• apparmor_bprm_committed_creds(9)
• apparmor_sk_clone_security(9)
• apparmor_unix_stream_connect(9)
• apparmor_unix_may_send(9)
• apparmor_socket_post_create(9)
• apparmor_socket_bind(9)
• apparmor_socket_getpeersec_stream(9)
• apparmor_socket_getpeersec_dgram(9)
• apparmor_socket_sock_rcv_skb(9)
• set_init_ctx(9)

go read them. all of them. it's a whole vibe 👑🔥

---

and that's the page!! source is ./security/apparmor, dated October 2026 — that's the version and the date, mwah 💋 hope this helped bestie, go forth and graft those socks 🧚💖