AUDIT_DELETE_RULE_DATA(3)

✨ NAME ✨

okay so bestie, welcome to the AUDIT_DELETE_RULE_DATA(3) page from the Linux Audit API 💖 this one is about audit_delete_rule_data — literally delete an audit rule. periodt.

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_delete_rule_data(int fd, struct audit_rule_data *rule, int flags, int action);"

🦋 DESCRIPTION 🦋

audit_delete_rule_data is used to delete rules that are currently loaded in the kernel. 👑

The file descriptor is given in fd, and the rule description is in rule. 💅

To delete a rule, you must set up the rules identical to the one being deleted. like, no cap, exact same setup or it's not gonna vibe. 😭

See audit_add_rule_data for flags and action definitions. 🫶

⭐ RETURN VALUE ⭐

The return value is <= 0 on error, otherwise it is the netlink sequence id number. ✨

This function can have any error that sendto would encounter. 💀

🌈 SEE ALSO 🌈

• audit_add_rule_data(3), auditctl(8).

🎀 AUTHOR 🎀

Steve Grubb 👑

and that's the whole vibe bestie! this page came from Red Hat, dated Oct 2006, and it's the AUDIT_DELETE_RULE_DATA(3) manual page. 🫶💖