label_compound_match(9)

💅 label_compound_match(9) 💅

okay so bestie, we're deep in the Kernel API Manual today — this is label_compound_match(9), and no cap, it's giving "the AppArmor internals page you read at 2am" energy. let's get into it 🫶

---

✨ NAME ✨

label_compound_match — literally the function that finds perms for a full compound label. that's the whole vibe. 💖

---

🦋 SYNOPSIS 🦋

int label_compound_match (const struct aa_profile *profile , struct
aa_ruleset *rules , struct aa_label *label , aa_state_t state , bool
inview , u32 request , struct aa_perms *perms );

like yes she's a long signature but she ate, fr fr 👑

---

🎀 ARGUMENTS 🎀

• profile — the profile you're finding perms for, bestie. that's the one. 🍓
• rules — the ruleset we're searching through, iykyk.
• label — the label whose access permissions we're checking. main character energy tbh.
• state — the state to start the match in. where we begin our little journey ✨
• inview — whether to match labels in view, or only in scope. two very different vibe checks 😌
• request — the permissions you're requesting. ask and you shall receive (maybe).
• perms — the perms struct we're gonna set. she's the output, she's iconic.

---

🔥 RETURN 🔥

the state match stopped at, OR DFA_NOMATCH if it aborted early. so like, either you get a state or you get shut down 💀

---

🌈 DESCRIPTION 🌈

okay so picture the label A//B//C — this function does the perm match for A//B//C. and listen, perms should be preinitialized with allperms OR a previous permission check to be stacked. no skipping that step, that's the rule 🙈

---

👑 SEE ALSO 👑

Kernel file ./security/apparmor/label.c, plus the whole friend group:

• ns_cmp(9)
• profile_cmp(9)
• vec_cmp(9)
• aa_vec_unique(9)
• aa_label_alloc(9)
• label_cmp(9)
• __aa_label_next_not_in_set(9)
• aa_label_is_subset(9)
• aa_label_is_unconfined_subset(9)
• __label_remove(9)
• __label_replace(9)
• __label_insert(9)
• __vec_find(9)
• __label_find(9)
• aa_label_remove(9)
• aa_label_replace(9)
• vec_find(9)
• aa_label_insert(9)
• aa_label_next_in_merge(9)
• label_merge_cmp(9)
• label_merge_insert(9)
• labelset_of_merge(9)
• __label_find_merge(9)
• aa_label_find_merge(9)
• aa_label_merge(9)
• label_components_match(9)
• aa_label_match(9)
• aa_update_label_name(9)
• aa_profile_snxprint(9)
• aa_label_snxprint(9)
• aa_label_asxprint(9)
• aa_label_acntsxprint(9)
• aa_label_strn_parse(9)
• aa_labelset_destroy(9)
• __label_update(9)
• __labelset_update(9)
• __aa_labelset_update_subtree(9)

---

and that's the page, bestie 💜 this one came from ./security/apparmor, stamped October 2026, and yeah — that's the whole label_compound_match(9) moment. slay, study it, and go read some AppArmor source 🧚✨