change_profile_perms(9)

💅 change_profile_perms(9) 💅

okay bestie, you’ve opened the Kernel API Manual page for change_profile_perms, and we’re gonna make it make sense. no cap, this is the function that finds permissions for change_profile. ✨

🌸 NAME 🌸

change_profile_perms — finds permissions for change_profile, and yes that’s the whole name vibe. 🎀

✨ SYNOPSIS ✨

here’s the signature, bestie — literally copy it exactly, no autocorrect:

int change_profile_perms (const struct aa_profile *profile , struct
       aa_label *target , bool stack , u32 request , aa_state_t start , struct
       aa_perms *perms );

🦋 ARGUMENTS 🦋

• profile — the current profile, and it is NOT NULL (do not test that limit, bestie 💀).
• target — the label to transition to, also NOT NULL (periodt).
• stack — whether this is a stacking request. yep, that’s the flag vibe.
• request — the requested perms.
• start — the state to start matching in.
• perms — Returns computed perms, and it is NOT NULL too. the function fills this cutie in. ✨

🧚 DESCRIPTION 🧚

okay so right now it only matches a full label like A//B//C or individual components like A, B, C — not arbitrary combinations. for example, Eg. A//B, C is not getting matched by this. it’s giving strict full-label-or-single-component energy, and that’s the current behavior. 💅

👑 RETURN 👑

permission set — that’s what comes back. iconic. 🔥

🌈 SEE ALSO 🌈

Kernel file ./security/apparmor/domain.c — go say hi to these related besties too:

• may_change_ptraced_domain(9)
• label_compound_match(9)
• label_components_match(9)
• label_match(9)
• aa_xattrs_match(9)
• find_attach(9)
• x_table_lookup(9)
• x_to_label(9)
• apparmor_bprm_creds_for_exec(9)
• aa_change_hat(9)
• aa_change_profile(9)

mwah 💋 — this page came from ./security/apparmor, dated October 2026, and it’s change_profile_perms(9). slay, you’re all caught up 🫶