GETAUID(2)

✨ GETAUID πŸ’… (section 2 of the System Calls Manual, bestie)

okay so this is a system call page, it lives in section 2, and it's literally called getauid β€” it's giving "retrieve audit session ID" energy 🌸


🌈 NAME 🌈

getauid β€” retrieve audit session ID πŸŽ€


πŸ¦‹ SYNOPSIS πŸ¦‹

#include <bsm/audit.h>

int
getauid(au_id_t *auid);

πŸ’– DESCRIPTION πŸ’–

so the getauid() system call retrieves the active audit session ID for the current process, and it hands it back through the au_id_t that auid points at. no cap. πŸ‘‘

heads up bestie: this system call requires an appropriate privilege to complete. so like… if you don't have it, it's not happening. 🚫

✨ RETURN VALUES ✨

upon successful completion, the value 0 is returned. πŸ₯³

otherwise, the value -1 is returned and the global variable errno is set to indicate the error. 😭 classic.


πŸ’€ ERRORS πŸ’€

the getauid() function will fail if:

  • [EFAULT] β€” a failure occurred while data transferred from the kernel failed. πŸ’€
  • [EPERM] β€” the process does not have sufficient permission to complete the operation. πŸ™ˆ (it's giving "not you, not today")

🌟 SEE ALSO 🌟

audit(2), auditon(2), getaudit(2), getaudit_addr(2), setaudit(2), setaudit_addr(2), setauid(2), libbsm(3)

iykyk 🫢 go read those next, they're all in the same friend group.


🧚 HISTORY 🧚

the OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in 2004. πŸ“…

it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. iconic behavior honestly. πŸ‘‘


πŸ‘‘ AUTHORS πŸ‘‘

this software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. additional authors include Wayne Salamon, Robert Watson, and SPARTA Inc. 🫢

the Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. 🌞

this manual page was written by Robert Watson <rwatson@FreeBSD.org>. πŸ’Œ


and that's the whole page, bestie!! πŸŽ€ this one's from Debian, dated April 19, 2005 β€” yeah it's vintage, it's serving archival realness, and it's still the GETAUID(2) you know and love. slay, stay privileged, and don't forget to check errno. πŸ’…βœ¨

πŸ“¦ where this page comes from