AUDIT_CLOSE(3)

💖 AUDIT_CLOSE 💖

okay bestie, welcome to the Linux Audit API corner of the manual, section 3 — yes this is AUDIT_CLOSE(3), we're doing the whole thing, sit down, hydrate, let's go 🫶

✨ NAME ✨

audit_close — close the audit netlink socket connection 🔌

like... it's the goodbye function. the "ok we're done here" function. the closing the door behind you function. periodt.

🌸 SYNOPSIS 🌸

#include <libaudit.h>

void audit_close(int fd);

she's short, she's simple, she takes one int and returns nothing. iconic behaviour honestly 💅

🦋 DESCRIPTION 🦋

okay so. audit_close() closes the NETLINK_AUDIT socket — that's the socket that does the talking with the kernel part of the Linux Audit Subsystem. it's the little phone line between your program and the kernel's audit machinery, and this function is you hanging up the phone 📞💀

and important: fd must have been returned by audit_open(3). like, don't just hand her any random file descriptor you found lying around. she needs that one. the one audit_open(3) gave you. no substitutions, no swaps, no "eh close enough" 🙈

lowkey this is the partner function to audit_open(3) — you open, you do your thing, you close. the full circle moment. the character arc. we love to see it ✨

💜 RETURN VALUE 💜

None.

that's it. that's the whole section. she returns nothing. no error code, no success code, no little nod of approval. void is void, bestie 🤷♀️💖

🎀 SEE ALSO 🎀

• audit_open(3) — the one who starts it all, the main character, the opener 🔥
• netlink(7) — the netlink lore, if you wanna go deeper 👑

👑 AUTHOR 👑

Steve Grubb — thank you for your service, king 🫡💖

and that's the whole page!! Red Hat put this out back in Apr 2021, and it's been living rent-free in section 3 of the Linux Audit API ever since 🌈⭐ go close those sockets responsibly, bestie, ily, mwah 💋🌸