AUDIT_CAN_CONTROL(3)

💖 AUDIT_CAN_CONTROL 💖

ok so bestie, welcome to the Linux Audit API section 3 era of your life 🌸 this is the page for audit_can_control, audit_can_write, and audit_can_read — the lil trio that tells you whether your process can do audit stuff. vibe check for capabilities, basically ✨

🎀 NAME 🎀

audit_can_control, audit_can_write, audit_can_read — test audit related capabilities 🕵️♀️

✨ SYNOPSIS ✨

#include <libaudit.h>

int audit_can_control(void);
int audit_can_write(void);
int audit_can_read(void);

like, three functions, no arguments, all vibes 🦋

💅 DESCRIPTION 💅

okay so here's the tea, bestie ☕

• audit_can_control() returns 1 if the calling process possesses the CAP_AUDIT_CONTROL capability, otherwise 0. she's asking "can I control the audit system??" 👑
• audit_can_write() returns 1 if CAP_AUDIT_WRITE is available. can you write to the audit log, or nah 💌
• audit_can_read() returns 1 if CAP_AUDIT_READ is present. reading the audit log is main character energy fr 📖✨

🫶 important caveat bestie: when libcap-ng support is not available these functions return 1 only when the effective UID is 0. so no libcap-ng = it's just doing a lil root check, periodt. no cap.

⭐ RETURN VALUE ⭐

These functions return 1 when the capability is present and 0 otherwise. that's it. that's the whole range. iconic simplicity tbh 💀

🌈 SEE ALSO 🌈

• audit_open(3).

go read that one next, iykyk 🧚

💜 AUTHOR 💜

Steve Grubb 💖

and that's a wrap on the July 2025 edition from Red Hat 🌸 thanks for reading bestie, now go check ur capabilities 🎀✨💅