---
name: "aa_query_label"
section: "2"
platform: "linux"
package: "apparmor"
version: "4.1.8-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/aa_query_label"
---

# aa\_query\_label(2)

query access permission associated with a label aa\_query\_file\_path, aa\_query\_file\_path\_len - query access permissions of a file path aa\_query\_link\_path, aa\_query\_link\_path\_len - query access permissions of a link path

## NAME

aa\_query\_label - query access permission associated with a label

aa\_query\_file\_path, aa\_query\_file\_path\_len - query access permissions of a file path

aa\_query\_link\_path, aa\_query\_link\_path\_len - query access permissions of a link path

## SYNOPSIS

**#include \<sys/apparmor.h\>**

**int aa\_query\_label(uint32\_t mask, char \*query, size\_t size, int \*allowed, int \*audited);**

**int aa\_query\_file\_path(uint32\_t mask, const char \*label, size\_t label\_len, const char \*path, int \*allowed, int \*audited);**

**int aa\_query\_file\_path\_len(uint32\_t mask, const char \*label, size\_t label\_len, const char \*path, size\_t path\_len, int \*allowed, int \*audited);**

**int aa\_query\_link\_path(const char \*label, const char \*target, const char \*link, int \*allowed, int \*audited);**

**int aa\_query\_link\_path\_len(const char \*label, size\_t label\_len, const char \*target, size\_t target\_len, const char \*link, size\_t link\_len, int \*allowed, int \*audited);**

Link with **-lapparmor** when compiling.

## DESCRIPTION

The **aa\_query\_label** function fetches the current permissions granted by the specified *label* in the *query* string.

The query is a raw binary formatted query, containing the label and permission query to make. The returned *allowed* and *audited* values are interpreted boolean values, simply stating whether the query is allowed and if it is audited.

The mask of the query string is a bit mask of permissions to query and is class type dependent (see **AA\_CLASS\_xxx** entries in *sys/apparmor.h*).

The format of the query string is also dependent on the **AA\_CLASS** and as such the **aa\_query\_xxx** helper functions should usually be used instead of directly using **aa\_query\_label**. If directly using the interface the *query* string is required to have a header of **AA\_QUERY\_CMD\_LABEL\_SIZE** that will be used by **aa\_query\_label**.

The **aa\_query\_file\_path** and **aa\_query\_file\_path\_len** functions are helper function that assemble a properly formatted file path query for the **aa\_query\_label** function. The *label* is a valid apparmor label as returned by *aa\_splitcon* with *label\_len* being the length of the *label*. The *path* is any valid filesystem path to query permissions for. For the **aa\_query\_file\_path\_len** variant the *path\_len* parameter specifies the number of bytes in the *path* to use as part of the query.

The **aa\_query\_link\_path** and **aa\_query\_link\_path\_len** functions are helper functions that assemble a properly formatted link path query for the **aa\_query\_label** function. The *link\_len* and *target\_len* parameters specify the number of bytes in the *link* and *target* to use as part of the query.

## RETURN VALUE

On success 0 is returned, and the *allowed* and *audited* parameters contain a boolean value of 0 not allowed/audited or 1 allowed/audited. On error, -1 is returned, and [**errno**(3)](/errno/3.md) is set appropriately.

## ERRORS

- **EINVAL**

  The requested *mask* is empty.

  The *size* of the query is less than the query **AA\_QUERY\_CMD\_LABEL\_SIZE**

  The apparmor kernel module is not loaded or the kernel interface access interface is not available

- **ENOMEM**

  Insufficient memory was available.

- **EACCES**

  Access to the specified *label* or query interface was denied.

- **ENOENT**

  The specified *label* does not exist or is not visible.

- **ERANGE**

  The confinement data is too large to fit in the supplied buffer.

## NOTES

The label permissions returned are only valid for the time of the query and can change at any point in the future.

## BUGS

None known. If you find any, please report them at \<https://gitlab.com/apparmor/apparmor/-/issues\>.

## SEE ALSO

[**apparmor**(7)](/apparmor/7.md), [**apparmor.d**(5)](/apparmor.d/5.md), [**apparmor\_parser**(8)](/apparmor_parser/8.md), [**aa\_getcon**(2)](/aa_getcon/2.md), [**aa\_splitcon**(3)](/aa_splitcon/3.md) and \<https://wiki.apparmor.net\>.