AUDIT(2)

💖 AUDIT(2) 💖 — the audit girlies' system call manual

okay bestie, so this is the audit page from the System Calls Manual, and it's literally the moment you get to ✨commit a BSM audit record to the audit log✨. no cap, it's giving security main character energy. let's go 🫶

---

✨ NAME ✨

audit — commit BSM audit record to audit log

---

🌸 SYNOPSIS 🌸

#include <bsm/audit.h>

int
audit(const char *record, u_int length);

---

🦋 DESCRIPTION 🦋

so the audit() system call submits a completed BSM audit record to the system audit log. that's it, that's the vibe. iconic behavior 💅

the record argument is a pointer to the specific event to be recorded, and length is the size in bytes of the data to be written. literally just "here's the record, here's how big it is" and the kernel takes it from there 🎀

---

⭐ RETURN VALUES ⭐

upon successful completion, the value 0 is returned 💖 otherwise the value -1 is returned and the global variable errno is set to indicate the error. so like, check your errno, bestie, she's always trying to tell you something 😭

---

🔥 ERRORS 🔥

the audit() system call will fail and the data never written if:

• [EFAULT] — the record argument is beyond the allocated address space of the process. 💀 like girl you're pointing at nothing.
• [EINVAL] — the token ID is invalid or length is larger than MAXAUDITDATA. too much, babe, the limit is the limit.
• [EPERM] — the process does not have sufficient permission to complete the operation. no permission, no entry 🙈

---

🌈 SEE ALSO 🌈

auditon(2), getaudit(2), getaudit_addr(2), getauid(2), setaudit(2), setaudit_addr(2), setauid(2), libbsm(3)

go read them, they're the friend group 🫶

---

👑 HISTORY 👑

the OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in 2004. it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. a whole glow-up arc, fr fr ✨

---

💜 AUTHORS 💜

this software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. additional authors include Wayne Salamon, Robert Watson, and SPARTA Inc.

the Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. legends, honestly 🌟

this manual page was written by Tom Rhodes <trhodes@FreeBSD.org>. thank you for your service, king 🎀

---

😭 BUGS 😭

the FreeBSD kernel does not fully validate that the argument passed is syntactically valid BSM. submitting invalid audit records may corrupt the audit log.

okay so this is the part where we get serious for one sec — submitting invalid audit records may corrupt the audit log, and the kernel isn't gonna hold your hand about it. not me being dramatic, it's literally in the manpage 💀 be careful.

---

Debian · April 19, 2005 · that's the source, version and date of this page, and that's the whole manual bestie — stay audited, stay slay, bye 💅🌈💖