Manpages - aa_query_label.2

aa_query_label - query access permission associated with a label

aa_query_file_path, aa_query_file_path_len - query access permissions of a file path

aa_query_link_path, aa_query_link_path_len - query access permissions of a link path

#include <sys/apparmor.h>

int aa_query_label(uint32_t mask, char *query, size_t size, int *allowed, int *audited);

int aa_query_file_path(uint32_t mask, const char *label, size_t label_len, const char *path, int *allowed, int *audited);

int aa_query_file_path_len(uint32_t mask, const char *label, size_t label_len, const char *path, size_t path_len, int *allowed, int *audited);

int aa_query_link_path(const char *label, const char *target, const char *link, int *allowed, int *audited);

int aa_query_link_path_len(const char *label, size_t label_len, const char *target, size_t target_len, const char *link, size_t link_len, int *allowed, int *audited);

Link with -lapparmor when compiling.

The aa_query_label function fetches the current permissions granted by the specified label in the query string.

The query is a raw binary formatted query, containing the label and permission query to make. The returned allowed and audited values are interpreted boolean values, simply stating whether the query is allowed and if it is audited.

The mask of the query string is a bit mask of permissions to query and is class type dependent (see AA_CLASS_xxx entries in sys/apparmor.h).

The format of the query string is also dependent on the AA_CLASS and as such the aa_query_xxx helper functions should usually be used instead of directly using aa_query_label. If directly using the interface the query string is required to have a header of AA_QUERY_CMD_LABEL_SIZE that will be used by aa_query_label.

The aa_query_file_path and aa_query_file_path_len functions are helper function that assemble a properly formatted file path query for the aa_query_label function. The label is a valid apparmor label as returned by aa_splitcon with label_len being the length of the label. The path is any valid filesystem path to query permissions for. For the aa_query_file_path_len variant the path_len parameter specifies the number of bytes in the path to use as part of the query.

The aa_query_link_path and aa_query_link_path_len functions are helper functions that assemble a properly formatted link path query for the aa_query_label function. The link_len and target_len parameters specify the number of bytes in the link and target to use as part of the query.

On success 0 is returned, and the allowed and audited parameters contain a boolean value of 0 not allowed/audited or 1 allowed/audited. On error, -1 is returned, and errno (3) is set appropriately.

EINVAL

The requested mask is empty. The size of the query is less than the query AA_QUERY_CMD_LABEL_SIZE The apparmor kernel module is not loaded or the kernel interface access interface is not available

ENOMEM

Insufficient memory was available.

EACCES

Access to the specified label or query interface was denied.

ENOENT

The specified label does not exist or is not visible.

ERANGE

The confinement data is too large to fit in the supplied buffer.

The label permissions returned are only valid for the time of the query and can change at any point in the future.

None known. If you find any, please report them at https://gitlab.com/apparmor/apparmor/-/issues.

apparmor (7), apparmor.d (5), apparmor_parser (8), aa_getcon (2), aa_splitcon (3) and https://wiki.apparmor.net.