AA\_QUERY\_LABEL(2) AppArmor AA\_QUERY\_LABEL(2)

# [NAME](#NAME)

aa\_query\_label - query access permission associated with a label

aa\_query\_file\_path, aa\_query\_file\_path\_len - query access permissions of a file path

aa\_query\_link\_path, aa\_query\_link\_path\_len - query access permissions of a link path

# [SYNOPSIS](#SYNOPSIS)

**#include <sys/apparmor.h>**

**int aa\_query\_label(uint32\_t mask, char \*query, size\_t size, int \*allowed, int \*audited);**

**int aa\_query\_file\_path(uint32\_t mask, const char \*label, size\_t label\_len, const char \*path, int \*allowed, int \*audited);**

**int aa\_query\_file\_path\_len(uint32\_t mask, const char \*label, size\_t label\_len, const char \*path, size\_t path\_len, int \*allowed, int \*audited);**

**int aa\_query\_link\_path(const char \*label, const char \*target, const char \*link, int \*allowed, int \*audited);**

**int aa\_query\_link\_path\_len(const char \*label, size\_t label\_len, const char \*target, size\_t target\_len, const char \*link, size\_t link\_len, int \*allowed, int \*audited);**

Link with **-lapparmor** when compiling.

# [DESCRIPTION](#DESCRIPTION)

The **aa\_query\_label** function fetches the current permissions granted by the specified *label* in the *query* string.

The query is a raw binary formatted query, containing the label and permission query to make. The returned *allowed* and *audited* values are interpreted boolean values, simply stating whether the query is allowed and if it is audited.

The mask of the query string is a bit mask of permissions to query and is class type dependent (see **AA\_CLASS\_xxx** entries in *sys/apparmor.h*).

The format of the query string is also dependent on the **AA\_CLASS** and as such the **aa\_query\_xxx** helper functions should usually be used instead of directly using **aa\_query\_label**. If directly using the interface the *query* string is required to have a header of **AA\_QUERY\_CMD\_LABEL\_SIZE** that will be used by **aa\_query\_label**.

The **aa\_query\_file\_path** and **aa\_query\_file\_path\_len** functions are helper function that assemble a properly formatted file path query for the **aa\_query\_label** function. The *label* is a valid apparmor label as returned by *aa\_splitcon* with *label\_len* being the length of the *label*. The *path* is any valid filesystem path to query permissions for. For the **aa\_query\_file\_path\_len** variant the *path\_len* parameter specifies the number of bytes in the *path* to use as part of the query.

The **aa\_query\_link\_path** and **aa\_query\_link\_path\_len** functions are helper functions that assemble a properly formatted link path query for the **aa\_query\_label** function. The *link\_len* and *target\_len* parameters specify the number of bytes in the *link* and *target* to use as part of the query.

# [RETURN VALUE](#RETURN_VALUE)

On success 0 is returned, and the *allowed* and *audited* parameters contain a boolean value of 0 not allowed/audited or 1 allowed/audited. On error, -1 is returned, and [**errno**(3)](/man/enterprise-packages/libapparmor/errno.3) is set appropriately.

# [ERRORS](#ERRORS)

[**EINVAL**](#EINVAL)

The requested *mask* is empty.

The *size* of the query is less than the query **AA\_QUERY\_CMD\_LABEL\_SIZE**

The apparmor kernel module is not loaded or the kernel interface access interface is not available

[**ENOMEM**](#ENOMEM)

Insufficient memory was available.

[**EACCES**](#EACCES)

Access to the specified *label* or query interface was denied.

[**ENOENT**](#ENOENT)

The specified *label* does not exist or is not visible.

[**ERANGE**](#ERANGE)

The confinement data is too large to fit in the supplied buffer.

# [NOTES](#NOTES)

The label permissions returned are only valid for the time of the query and can change at any point in the future.

# [BUGS](#BUGS)

None known. If you find any, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

# [SEE ALSO](#SEE_ALSO)

[**apparmor**(7)](/man/enterprise-packages/libapparmor/apparmor.7), [**apparmor.d**(5)](/man/enterprise-packages/libapparmor/apparmor.d.5), [**apparmor\_parser**(8)](/man/enterprise-packages/libapparmor/apparmor_parser.8), [**aa\_getcon**(2)](/man/enterprise-packages/libapparmor/aa_getcon.2), [**aa\_splitcon**(3)](/man/enterprise-packages/libapparmor/aa_splitcon.3) and <https://wiki.apparmor.net>.

2026-10-26 AppArmor 5.0.2

---

Document: aa_query_label(2) from libapparmor 5.0.2-r3 (Chainguard OS)
Source: https://gitlab.com/apparmor/apparmor.git