find_attach(9)

💖 find_attach 💖

Hiii bestie, welcome to the Kernel API Manual, section 9 edition 🫶. This page is all about find_attach, and yes, it's literally doing attachment search for unconfined processes. Every pointer down there is NOT NULL, so don't try to sneak a null in, okay? 😭💅

---

✨ NAME ✨

find_attach — do attachment search for unconfined processes. That's the vibe: attachment search, unconfined processes, iconic behavior, periodt 💖.

---

🦋 SYNOPSIS 🦋

struct aa_label * find_attach (const struct path *path , struct aa_ns *ns , struct list_head *head , const char *name , const char **info );

---

🎀 ARGUMENTS 🎀

• path — path of file in question, and it is NOT NULL. fr fr, not null 🙈.
• ns — the current namespace, NOT NULL. main character namespace energy 👑.
• head — profile list to walk, NOT NULL. you're walking the list, bestie 🚶‍♀️.
• name — to match against, NOT NULL. matching time ✨.
• info — info message if there was an error, NOT NULL. so if something goes sideways, this is where the tea gets reported 💀.

---

🔥 DESCRIPTION 🔥

okay so find_attach does a linear search on the profiles in the list. Slay, but make it linear 💅.

There's a matching preference, and it's giving very "ranked choice, but kernel profiles":

• an exact match is preferred over a name which uses expressions to match, and
• matching expressions with the greatest xmatch_len are preferred. iykyk ✨.

Requires: head not be shared or have appropriate locks held. This is not a drill, bestie — get your locking situation correct 😭🔒.

---

⭐ RETURN ⭐

• Returns a label, or NULL if no match found. No match, no label, just NULL and vibes 💀.

---

🌈 SEE ALSO 🌈

This page is in a whole friend group of kernel AppArmor functions plus one file path, so here's the full roll call 🫶:

• Kernel file ./security/apparmor/domain.c
• may_change_ptraced_domain(9)
• label_compound_match(9)
• label_components_match(9)
• label_match(9)
• change_profile_perms(9)
• aa_xattrs_match(9)
• x_table_lookup(9)
• x_to_label(9)
• apparmor_bprm_creds_for_exec(9)
• aa_change_hat(9)
• aa_change_profile(9)

---

that's the whole page, bestie 🎀. This little gem comes from ./security/apparmor, dated October 2026, and it is absolutely living its best kernel-manual life. mwah 💋✨