query_data(9)

💅 query_data — the kernel API manual, bestie edition 🎀

okay so this is query_data(9) from the Kernel API Manual and honestly? she's a little icon. let's get into it ✨

---

✨ NAME ✨

query_data — queries a policy and writes its data to buf 💖

like, you ask a policy a question and she answers by yeeting her data straight into buf. no cap.

---

🌸 SYNOPSIS 🌸

ssize_t query_data (char *buf , size_t buf_len , char *query , size_t
       query_len );

that's the whole vibe right there ^^ four arguments, one ssize_t return, periodt.

---

🦋 ARGUMENTS 🦋

• buf — the resulting data is stored here (NOT NULL) 🫶 like this is where the answer goes. and no, she cannot be NULL, don't even try it.
• buf_len — size of buf ✨ gotta tell her how much room she's working with.
• query — query string used to retrieve data 🌸 the actual question, bestie.
• query_len — size of query including second NUL byte 👀 yes, the second one. it's counting that extra NUL, keep up.

---

💜 DESCRIPTION 💜

okay so the buffers pointed to by buf and query may overlap. the way that this is totally fine because the query buffer is parsed before buf is written to — so she reads first, writes second, no drama 💅

the query should look like "<LABEL> <KEY> ", where <LABEL> is the name of the security confinement context and <KEY> is the name of the data to retrieve 🔥

and listen — <LABEL> and <KEY> must not be NUL-terminated. like, don't. that's not the assignment 🙈

⚠️ real talk: don't expect the contents of buf to be preserved on failure. if it flops, buf is in whatever state it's in. she's not cleaning up after herself, and you shouldn't assume she did 😭

---

⭐ RETURN ⭐

number of characters written to buf, or -errno on failure 💀 that's it, that's the whole return section. slay.

---

🌈 SEE ALSO 🌈

buckle up bestie, this list is long and we are not skipping a single one, iykyk 👑

Kernel file ./security/apparmor/apparmorfs.c:

• mangle_name(9)
• __aafs_setup_d_inode(9)
• aafs_create(9)
• aafs_create_file(9)
• aafs_create_dir(9)
• aafs_remove(9)
• aa_simple_write_to_buffer(9)
• aa_get_data_from_compressed(9)
• query_label(9)
• aa_write_access(9)
• __next_ns(9)
• __first_profile(9)
• __next_profile(9)
• next_profile(9)
• p_start(9)
• p_next(9)
• p_stop(9)
• seq_show_profile(9)
• entry_create_file(9)
• entry_create_dir(9)
• entry_remove_file(9)
• entry_remove_dir(9)
• aa_destroy_aafs(9)
• aa_create_aafs(9)

every single one, accounted for, no crumbs left behind 🍓

---

k that's the whole page, hope it ate 💖 this masterpiece lives over at ./security/apparmor and she's stamped October 2026 — go off, calendar queen 👑✨