may_change_ptraced_domain(9)

okay so bestie, welcome to may_change_ptraced_domain(9) from the Kernel API Manual — we’re doing AppArmor domain-change permission checks today and honestly it’s giving very specific kernel energy 💅✨

🎀 NAME 🎀

may_change_ptraced_domain — check if can change profile on ptraced task 🫶

✨ SYNOPSIS ✨

int may_change_ptraced_domain (const struct cred *to_cred , struct
       aa_label *to_label , const char **info );

💖 ARGUMENTS 💖

• to_cred — cred of task changing domain.
• to_label — profile to change to — and it is NOT NULL, no cap 🙈.
• info — message if there is an error.

🌸 DESCRIPTION 🌸

Okay so the actual vibe check: it checks if current is ptraced, and if it is, it checks if the tracing task is allowed to trace the new domain 🔥. That’s the whole job, bestie.

🦋 RETURN 🦋

• 0 or error if change not allowed 😭.

🌈 SEE ALSO 🌈

Kernel file ./security/apparmor/domain.c — plus these little icons:

• label_compound_match(9)
• label_components_match(9)
• label_match(9)
• change_profile_perms(9)
• aa_xattrs_match(9)
• find_attach(9)
• x_table_lookup(9)
• x_to_label(9)
• apparmor_bprm_creds_for_exec(9)
• aa_change_hat(9)
• aa_change_profile(9)

okay bye bestie! This page’s source/version lives under ./security/apparmor and it’s dated October 2026. may_change_ptraced_domain(9) out — slay and read your kernel docs 💅🎀🫶