AUDIT_ADD_RULE_DATA(3)

💖 AUDIT_ADD_RULE_DATA 💖

okay bestie, so this one lives in the Linux Audit API section of the manual (section 3, the library-calls girlies 🫶), and it's literally the moment your handcrafted audit rule finally gets yeeted into the kernel. let's get into it.

---

✨ NAME ✨

audit_add_rule_data — add a brand new audit rule. that's it. that's the vibe. 💅

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_add_rule_data(int fd, struct audit_rule_data *rule, int flags, int action);

---

🦋 DESCRIPTION 🦋

so here's the tea: audit_add_rule_data takes an audit rule that you already built with audit_rule_fieldpair_data(3) and drops it into one of the kernel's several event filters. which filter tho?? that's decided by the fd file descriptor and the flags argument. periodt.

the possible values for flags are giving very much menu-of-destiny:

• AUDIT_FILTER_USER — apply the rule to userspace generated messages. this is the user filter. normally all user space originating events are accepted, and rules on this filter are typically written to block specific events. 🚫
• AUDIT_FILTER_TASK — apply the rule at task creation (not syscall). this is the task filter. it's normally used to exclude an application from being audited. 🙈
• AUDIT_FILTER_EXIT — apply the rule at syscall exit. this is the main filter, the one used for syscalls and filesystem watches. normally all syscalls do not trigger events, so this is normally used to specify the events that are actually of interest. main character filter fr fr 👑
• AUDIT_FILTER_EXCLUDE — apply the rule at audit_log_start. this is the exclude filter, which discards any records that match. the action type is ignored for this filter and defaults to "never". 😭
• AUDIT_FILTER_FS — apply the rule when adding PATH auxiliary records to SYSCALL events. this is the filesystem filter, used to ignore PATH records that are not of interest. 🧚

and the rule's action? only two possible values, no more no less:

• AUDIT_NEVER — do not build context if the rule matches. 💀
• AUDIT_ALWAYS — generate an audit record if the rule matches. 🔥

---

⭐ RETURN VALUE ⭐

the return value is <= 0 on error. otherwise? it's the netlink sequence id number. and ngl this function can have any error that sendto would encounter — so whatever sendto is going through, she's going through too. 💜

---

🌈 SEE ALSO 🌈

• audit_rule_fieldpair_data(3)
• audit_delete_rule_data(3)
• auditctl(8)

---

🎀 AUTHOR 🎀

Steve Grubb. ty for your service king 🫶

---

and that's a wrap bestie!! this page came to you courtesy of Red Hat, dated Aug 2009 — yes she's an elder but she's still iconic, no cap. ✨💖🦋