--- name: "aa_kernel_interface" section: "3" platform: "linux" package: "apparmor" version: "4.1.8-2" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/aa_kernel_interface" --- # aa\_kernel\_interface(3) an opaque object representing the AppArmor kernel interface for policy loading, replacing, and removing aa\_kernel\_interface\_new - create a new aa\_kernel\_interface object from an optional path aa\_kernel\_interface\_ref - increments the ref count of an aa\_kernel\_interface object aa\_kernel\_interface\_unref - decrements the ref count and frees the aa\_kernel\_interface object when 0 aa\_kernel\_interface\_load\_policy - load a policy from a buffer into the kernel aa\_kernel\_interface\_load\_policy\_from\_file - load a policy from a file into the kernel aa\_kernel\_interface\_load\_policy\_from\_fd - load a policy from a file descriptor into the kernel aa\_kernel\_interface\_replace\_policy - replace a policy in the kernel with a policy from a buffer aa\_kernel\_interface\_replace\_policy\_from\_file - replace a policy in the kernel with a policy from a file aa\_kernel\_interface\_replace\_policy\_from\_fd - replace a policy in the kernel with a policy from a file descriptor aa\_kernel\_interface\_remove\_policy - remove a policy from the kernel aa\_kernel\_interface\_write\_policy - write a policy to a file descriptor ## NAME aa\_kernel\_interface - an opaque object representing the AppArmor kernel interface for policy loading, replacing, and removing aa\_kernel\_interface\_new - create a new aa\_kernel\_interface object from an optional path aa\_kernel\_interface\_ref - increments the ref count of an aa\_kernel\_interface object aa\_kernel\_interface\_unref - decrements the ref count and frees the aa\_kernel\_interface object when 0 aa\_kernel\_interface\_load\_policy - load a policy from a buffer into the kernel aa\_kernel\_interface\_load\_policy\_from\_file - load a policy from a file into the kernel aa\_kernel\_interface\_load\_policy\_from\_fd - load a policy from a file descriptor into the kernel aa\_kernel\_interface\_replace\_policy - replace a policy in the kernel with a policy from a buffer aa\_kernel\_interface\_replace\_policy\_from\_file - replace a policy in the kernel with a policy from a file aa\_kernel\_interface\_replace\_policy\_from\_fd - replace a policy in the kernel with a policy from a file descriptor aa\_kernel\_interface\_remove\_policy - remove a policy from the kernel aa\_kernel\_interface\_write\_policy - write a policy to a file descriptor ## SYNOPSIS **#include \** **typedef struct aa\_kernel\_interface aa\_kernel\_interface;** **int aa\_kernel\_interface\_new(aa\_kernel\_interface \*\*kernel\_interface, aa\_features \*kernel\_features, const char \*apparmorfs);** **aa\_kernel\_interface \*aa\_kernel\_interface\_ref(aa\_kernel\_interface \*kernel\_interface);** **void aa\_kernel\_interface\_unref(aa\_kernel\_interface \*kernel\_interface);** **int aa\_kernel\_interface\_load\_policy(aa\_kernel\_interface \*kernel\_interface, const char \*buffer, size\_t size);** **int aa\_kernel\_interface\_load\_policy\_from\_file(aa\_kernel\_interface \*kernel\_interface, int dirfd, const char \*path);** **int aa\_kernel\_interface\_load\_policy\_from\_fd(aa\_kernel\_interface \*kernel\_interface, int fd);** **int aa\_kernel\_interface\_replace\_policy(aa\_kernel\_interface \*kernel\_interface, const char \*buffer, size\_t size);** **int aa\_kernel\_interface\_replace\_policy\_from\_file(aa\_kernel\_interface \*kernel\_interface, int dirfd, const char \*path);** **int aa\_kernel\_interface\_replace\_policy\_from\_fd(aa\_kernel\_interface \*kernel\_interface, int fd);** **int aa\_kernel\_interface\_remove\_policy(aa\_kernel\_interface \*kernel\_interface, const char \*fqname);** **int aa\_kernel\_interface\_write\_policy(int fd, const char \*buffer, size\_t size);** Link with **-lapparmor** when compiling. ## DESCRIPTION The *aa\_kernel\_interface* object contains information about the AppArmor kernel interface for policy loading, replacing, and removing. The **aa\_kernel\_interface\_new()** function creates an *aa\_kernel\_interface* object based on an optional *aa\_features* object and an optional path to the apparmor directory of securityfs, which is typically found at "/sys/kernel/security/apparmor/". If *kernel\_features* is NULL, then the features of the current kernel are used. When specifying a valid *kernel\_features* object, it must be compatible with the features of the currently running kernel. If *apparmorfs* is NULL, then the default location is used. The allocated *kernel\_interface* object must be freed using **aa\_kernel\_interface\_unref()**. **aa\_kernel\_interface\_ref()** increments the reference count on the *kernel\_interface* object. **aa\_kernel\_interface\_unref()** decrements the reference count on the *kernel\_interface* object and releases all corresponding resources when the reference count reaches zero. The **aa\_kernel\_interface\_load()** family of functions load a policy into the kernel. The operation will fail if a policy of the same name is already loaded. Use the **aa\_kernel\_interface\_replace()** family of functions if you wish to replace a previously loaded policy with a new policy of the same name. The **aa\_kernel\_interface\_replace()** functions can also be used to load a policy that does not correspond to a previously loaded policy. When loading or replacing from a buffer, the *buffer* will contain binary data. The *size* argument must specify the size of the *buffer* argument. When loading or replacing from a file, the *dirfd* and *path* combination are used to specify the location of the file. See the [**openat**(2)](/openat/2.md) man page for examples of *dirfd* and *path*. It is also possible to load or replace from a file descriptor specified by the *fd* argument. The file must be open for reading and the file offset must be set appropriately. The **aa\_kernel\_interface\_remove\_policy()** function can be used to unload a previously loaded policy. The fully qualified policy name must be specified with the *fqname* argument. The operation will fail if a policy matching *fqname* is not found. The **aa\_kernel\_interface\_write\_policy()** function allows for a policy, which is stored in *buffer* and consists of *size* bytes, to be written to a file descriptor. The *fd* must be open for writing and the file offset must be set appropriately. ## RETURN VALUE The **aa\_kernel\_interface\_new()** function returns 0 on success and *\*kernel\_interface* will point to an *aa\_kernel\_interface* object that must be freed by **aa\_kernel\_interface\_unref()**. -1 is returned on error, with errno set appropriately, and *\*kernel\_interface* will be set to NULL. **aa\_kernel\_interface\_ref()** returns the value of *kernel\_interface*. The **aa\_kernel\_interface\_load()** family of functions, the **aa\_kernel\_interface\_replace()** family of functions, **aa\_kernel\_interface\_remove()**, and **aa\_kernel\_interface\_write\_policy()** return 0 on success. -1 is returned on error, with errno set appropriately. ## ERRORS The errno value will be set according to the underlying error in the *aa\_kernel\_interface* family of functions that return -1 on error. ## NOTES All aa\_kernel\_interface functions described above are present in libapparmor version 2.10 and newer. **aa\_kernel\_interface\_unref()** saves the value of errno when called and restores errno before exiting in libapparmor version 2.12 and newer. ## BUGS None known. If you find any, please report them at \. ## SEE ALSO [**aa\_features**(3)](/aa_features/3.md), [**openat**(2)](/openat/2.md) and \.