apparmor_unix_may_send(9)

💅 apparmor_unix_may_send(9) — the kernel API manual page, bestie edition

okay so you've wandered into apparmor_unix_may_send(9), part of the Kernel API Manual (yes, kernel 9th-section, we're fancy like that). sit down, hydrate, and let's talk about who's allowed to yeet a unix datagram at whom 🫶

---

✨ NAME ✨

apparmor_unix_may_send — the vibe-check-before-you-send function: it checks perms before a conn or before sending unix dgrams 💌

---

🎀 SYNOPSIS 🎀

int apparmor_unix_may_send (struct socket *sock , struct socket *peer );

---

🦋 ARGUMENTS 🦋

• sock — the socket that's doing the sending, i.e. the one holding the message and the audacity 💅
• peer — the socket the message is being send to (yes, send, the original said it, we respect the original) 🎯

---

🌸 DESCRIPTION 🌸

so what it actually does: it performs bidirectional permission checks for Unix domain socket communication. both directions, no skipping, no shortcuts. it's giving thorough 👑

1. Verifies the sender has AA_MAY_SEND to the target socket ✅
2. Verifies the receiver has AA_MAY_RECEIVE from the source socket ✅

and like, important detail: sock and peer are locked when this hook is called, called by:

dgram_connect peer setup but path not copied to newsk

(that's the whole note, don't ask me for more, that's what the page says 🙈)

---

🔥 RETURN 🔥

• 0 — transmission is permitted, go off, slay, the datagram may fly 🌈
• error code — on denial or failure 😭 no send for you

---

👑 SEE ALSO 👑

Kernel file ./security/apparmor/lsm.c and honestly the whole friend group:

• common_perm(9)
• common_perm_cond(9)
• common_perm_dir_dentry(9)
• common_perm_rm(9)
• common_perm_create(9)
• apparmor_uring_override_creds(9)
• apparmor_uring_sqpoll(9)
• apparmor_bprm_committing_creds(9)
• apparmor_bprm_committed_creds(9)
• apparmor_sk_clone_security(9)
• apparmor_unix_stream_connect(9)
• apparmor_socket_post_create(9)
• apparmor_socket_bind(9)
• apparmor_socket_getpeersec_stream(9)
• apparmor_socket_getpeersec_dgram(9)
• apparmor_sock_graft(9)
• apparmor_socket_sock_rcv_skb(9)
• set_init_ctx(9)

---

ngl bestie, if you're reading a section-9 kernel page for fun, you're literally the main character of the group chat 🧚💜

---

and that's the whole thing! brought to you by ./security/apparmor, dated October 2026, filed under apparmor_unix_may_send(9). periodt. 💖⭐