AUDITCTL(2)

📦
version 1.1 · 2 versions
, in nixos 26.05, nixpkgs unstable

💅 AUDITCTL(2) — like, the system calls manual, bestie

okay so this is auditctl(2) out of the System Calls Manual, and ngl it's a short one but it's got lore 👑

✨ NAME ✨

auditctl — configure system audit parameters 🎀

🦋 SYNOPSIS 🦋

#include <bsm/audit.h>

int
auditctl(const char *path);

🌸 DESCRIPTION 🌸

so the auditctl() system call literally just tells the kernel "hey bestie, open a new audit trail log file for me" 💖 and it's giving gatekept because it requires an appropriate privilege — so no, you can't just rock up without clearance, the vibe check is strict 🙈

one thing to be super clear on: auditctl() opens new files, but auditon(2) is what you use to disable the audit log. so don't come for auditctl() for that, it's not its job, it's not its era, periodt 💅

🎀 RETURN VALUES 🎀

  • 0 — slay, it worked, successful completion ✨
  • -1 — not slay 😭, and the global variable errno gets set to indicate the error so you know exactly what went wrong

🔥 ERRORS 🔥

the auditctl() system call will fail if:

  • [EINVAL] — The path is invalid. it's giving "that's not a path, that's a cry for help" 💀
  • [EPERM] — The process does not have sufficient permission to complete the operation. no privilege, no service, sorry babe 🫶

👑 SEE ALSO 👑

go read those too, iykyk 📚

🌈 HISTORY 🌈

the OpenBSM implementation was created by McAfee Research (the security division of McAfee Inc., not to be confused with anything else) under contract to Apple Computer Inc. in 2004 🍓 and it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. iconic lineage fr fr ⭐

🧚 AUTHORS 🧚

This software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. 💜

Additional authors include Wayne Salamon, Robert Watson, and SPARTA Inc. 🫶

The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems ☀️

This manual page was written by Robert Watson <rwatson@FreeBSD.org> ✍️

no cap, that's the whole page — short, sweet, and fully privileged 💅

mwah 💖 this one shipped from Debian, dated April 19, 2005 — yeah she's a vintage icon, we stan a classic 🎀✨

📦 where this page comes from