aa\_kernel\_interface(3) AppArmor aa\_kernel\_interface(3)

# [NAME](#NAME)

aa\_kernel\_interface - an opaque object representing the AppArmor kernel interface for policy loading, replacing, and removing

aa\_kernel\_interface\_new - create a new aa\_kernel\_interface object from an optional path

aa\_kernel\_interface\_ref - increments the ref count of an aa\_kernel\_interface object

aa\_kernel\_interface\_unref - decrements the ref count and frees the aa\_kernel\_interface object when 0

aa\_kernel\_interface\_load\_policy - load a policy from a buffer into the kernel

aa\_kernel\_interface\_load\_policy\_from\_file - load a policy from a file into the kernel

aa\_kernel\_interface\_load\_policy\_from\_fd - load a policy from a file descriptor into the kernel

aa\_kernel\_interface\_replace\_policy - replace a policy in the kernel with a policy from a buffer

aa\_kernel\_interface\_replace\_policy\_from\_file - replace a policy in the kernel with a policy from a file

aa\_kernel\_interface\_replace\_policy\_from\_fd - replace a policy in the kernel with a policy from a file descriptor

aa\_kernel\_interface\_remove\_policy - remove a policy from the kernel

aa\_kernel\_interface\_write\_policy - write a policy to a file descriptor

# [SYNOPSIS](#SYNOPSIS)

**#include <sys/apparmor.h>**

**typedef struct aa\_kernel\_interface aa\_kernel\_interface;**

**int aa\_kernel\_interface\_new(aa\_kernel\_interface \*\*kernel\_interface, aa\_features \*kernel\_features, const char \*apparmorfs);**

**aa\_kernel\_interface \*aa\_kernel\_interface\_ref(aa\_kernel\_interface \*kernel\_interface);**

**void aa\_kernel\_interface\_unref(aa\_kernel\_interface \*kernel\_interface);**

**int aa\_kernel\_interface\_load\_policy(aa\_kernel\_interface \*kernel\_interface, const char \*buffer, size\_t size);**

**int aa\_kernel\_interface\_load\_policy\_from\_file(aa\_kernel\_interface \*kernel\_interface, int dirfd, const char \*path);**

**int aa\_kernel\_interface\_load\_policy\_from\_fd(aa\_kernel\_interface \*kernel\_interface, int fd);**

**int aa\_kernel\_interface\_replace\_policy(aa\_kernel\_interface \*kernel\_interface, const char \*buffer, size\_t size);**

**int aa\_kernel\_interface\_replace\_policy\_from\_file(aa\_kernel\_interface \*kernel\_interface, int dirfd, const char \*path);**

**int aa\_kernel\_interface\_replace\_policy\_from\_fd(aa\_kernel\_interface \*kernel\_interface, int fd);**

**int aa\_kernel\_interface\_remove\_policy(aa\_kernel\_interface \*kernel\_interface, const char \*fqname);**

**int aa\_kernel\_interface\_write\_policy(int fd, const char \*buffer, size\_t size);**

Link with **-lapparmor** when compiling.

# [DESCRIPTION](#DESCRIPTION)

The *aa\_kernel\_interface* object contains information about the AppArmor kernel interface for policy loading, replacing, and removing.

The **aa\_kernel\_interface\_new()** function creates an *aa\_kernel\_interface* object based on an optional *aa\_features* object and an optional path to the apparmor directory of securityfs, which is typically found at "/sys/kernel/security/apparmor/". If *kernel\_features* is NULL, then the features of the current kernel are used. When specifying a valid *kernel\_features* object, it must be compatible with the features of the currently running kernel. If *apparmorfs* is NULL, then the default location is used. The allocated *kernel\_interface* object must be freed using **aa\_kernel\_interface\_unref()**.

**aa\_kernel\_interface\_ref()** increments the reference count on the *kernel\_interface* object.

**aa\_kernel\_interface\_unref()** decrements the reference count on the *kernel\_interface* object and releases all corresponding resources when the reference count reaches zero.

The **aa\_kernel\_interface\_load()** family of functions load a policy into the kernel. The operation will fail if a policy of the same name is already loaded. Use the **aa\_kernel\_interface\_replace()** family of functions if you wish to replace a previously loaded policy with a new policy of the same name. The **aa\_kernel\_interface\_replace()** functions can also be used to load a policy that does not correspond to a previously loaded policy.

When loading or replacing from a buffer, the *buffer* will contain binary data. The *size* argument must specify the size of the *buffer* argument.

When loading or replacing from a file, the *dirfd* and *path* combination are used to specify the location of the file. See the [**openat**(2)](/man/enterprise-packages/libapparmor/openat.2) man page for examples of *dirfd* and *path*.

It is also possible to load or replace from a file descriptor specified by the *fd* argument. The file must be open for reading and the file offset must be set appropriately.

The **aa\_kernel\_interface\_remove\_policy()** function can be used to unload a previously loaded policy. The fully qualified policy name must be specified with the *fqname* argument. The operation will fail if a policy matching *fqname* is not found.

The **aa\_kernel\_interface\_write\_policy()** function allows for a policy, which is stored in *buffer* and consists of *size* bytes, to be written to a file descriptor. The *fd* must be open for writing and the file offset must be set appropriately.

# [RETURN VALUE](#RETURN_VALUE)

The **aa\_kernel\_interface\_new()** function returns 0 on success and *\*kernel\_interface* will point to an *aa\_kernel\_interface* object that must be freed by **aa\_kernel\_interface\_unref()**. -1 is returned on error, with errno set appropriately, and *\*kernel\_interface* will be set to NULL.

**aa\_kernel\_interface\_ref()** returns the value of *kernel\_interface*.

The **aa\_kernel\_interface\_load()** family of functions, the **aa\_kernel\_interface\_replace()** family of functions, **aa\_kernel\_interface\_remove()**, and **aa\_kernel\_interface\_write\_policy()** return 0 on success. -1 is returned on error, with errno set appropriately.

# [ERRORS](#ERRORS)

The errno value will be set according to the underlying error in the *aa\_kernel\_interface* family of functions that return -1 on error.

# [NOTES](#NOTES)

All aa\_kernel\_interface functions described above are present in libapparmor version 2.10 and newer.

**aa\_kernel\_interface\_unref()** saves the value of errno when called and restores errno before exiting in libapparmor version 2.12 and newer.

# [BUGS](#BUGS)

None known. If you find any, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

# [SEE ALSO](#SEE_ALSO)

[**aa\_features**(3)](/man/enterprise-packages/libapparmor/aa_features.3), [**openat**(2)](/man/enterprise-packages/libapparmor/openat.2) and <https://wiki.apparmor.net>.

2026-09-13 AppArmor 5.0.2

---

Document: aa_kernel_interface(3) from libapparmor 5.0.2-r2 (Chainguard OS)
Source: https://gitlab.com/apparmor/apparmor.git