profile_capable(9)

okay so bestie, welcome to profile_capable(9) — the Kernel API Manual page that’s about to explain itself. 💅 No cap, every detail is staying.

🌸 NAME 🌸

profile_capable — test if profile allows use of capability @cap. periodt. ✨

✨ SYNOPSIS ✨

here’s the signature, character-for-character, don’t let the line break scare you:

int profile_capable (struct aa_profile *profile , int cap , unsigned int
       opts , struct apparmor_audit_data *ad );

🎀 ARGUMENTS 🎀

• profile — the profile being enforced. It’s NOT NULL and not unconfined (the original is very loud about this, and honestly same). 🫶
• cap — the capability to test if allowed. 🔥
• opts — the CAP_OPT_NOAUDIT bit determines whether an audit record is generated. 👀
• ad — audit data, and it is NOT NULL. periodt.

🔥 RETURN 🔥

0 if allowed, else -EPERM — that’s the whole mood. ✅💀

🦋 SEE ALSO 🦋

• Kernel file ./security/apparmor/capability.c
• audit_cb(9)
• audit_caps(9)
• aa_capable(9)

mwah 💋 — source/version ./security/apparmor, date October 2026, page profile_capable(9). byeee 🎀