aa\_splitcon(3) AppArmor aa\_splitcon(3)

# [NAME](#NAME)

aa\_splitcon - split the confinement context into a label and mode

# [SYNOPSIS](#SYNOPSIS)

**#include <sys/apparmor.h>**

**char \*aa\_splitcon(char \*con, char \*\*mode);**

Link with **-lapparmor** when compiling.

# [DESCRIPTION](#DESCRIPTION)

The **aa\_splitcon()** function splits a confinement context into separate label and mode strings. The @con string is modified so that the label portion is NUL terminated. The enforcement mode is also NUL terminated and the parenthesis surrounding the mode are removed. If @mode is non-NULL, it will point to the first character in the enforcement mode string on success.

The Linux kernel's /proc/<PID>/attr/current interface appends a trailing newline character to AppArmor contexts that are read from that file. If @con contains a single trailing newline character, it will be stripped by **aa\_splitcon()** prior to all other processing.

# [RETURN VALUE](#RETURN_VALUE)

Returns a pointer to the first character in the label string. NULL is returned on error.

# [EXAMPLE](#EXAMPLE)

```
 Context                        Label               Mode 
 -----------------------------  ------------------  -------
 unconfined                     unconfined          NULL
 unconfined\n                   unconfined          NULL
 /bin/ping (enforce)            /bin/ping           enforce
 /bin/ping (enforce)\n          /bin/ping           enforce
 /usr/sbin/rsyslogd (complain)  /usr/sbin/rsyslogd  complain
```

# [BUGS](#BUGS)

None known. If you find any, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

# [SEE ALSO](#SEE_ALSO)

[**aa\_getcon**(2)](/man/enterprise-packages/libapparmor/aa_getcon.2) and <https://wiki.apparmor.net>.

2026-09-13 AppArmor 5.0.2

---

Document: aa_splitcon(3) from libapparmor 5.0.2-r2 (Chainguard OS)
Source: https://gitlab.com/apparmor/apparmor.git