label_match(9)

💖 NAME 💖

okay so bestie, this is label_match(9) from the Kernel API Manual ✨ and it does a multi-component label match — lowkey iconic, highkey essential 💅.

🌸 SYNOPSIS 🌸

int label_match (const struct aa_profile *profile , struct aa_label
       label , bool stack , aa_state_t state , bool inview , u32 request ,
       struct aa_perms *perms );

🎀 ARGUMENTS 🎀

here's the whole cast, fr fr:

• profile — profile to match against, NOT NULL. no cap, it's required 💅.
• label — label to match, NOT NULL too. bestie, it's mandatory 🫶.
• stack — whether this is a stacking request. yes, that's the vibe 🦋.
• state — state to start in.
• inview — whether to match labels in view or only in scope. iykyk 🌸.
• request — permission request.
• perms — Returns computed perms. NOT NULL, so don't skip it 🙈.

✨ RETURN ✨

the state the match finished in, may be the none matching state 😭. that's the return vibe — periodt.

🦋 SEE ALSO 🦋

the bestie roster, no cap:

• Kernel file ./security/apparmor/domain.c — may_change_ptraced_domain(9)
• label_compound_match(9)
• label_components_match(9)
• change_profile_perms(9)
• aa_xattrs_match(9)
• find_attach(9)
• x_table_lookup(9)
• x_to_label(9)
• apparmor_bprm_creds_for_exec(9)
• aa_change_hat(9)
• aa_change_profile(9)

xoxo bestie 🫶 source/version: ./security/apparmor; dated October 2026; page: label_match(9) ✨