AUDIT_ENCODE_NV_STRING(3)

💖 AUDIT_ENCODE_NV_STRING(3) 💖

okay bestie, welcome to the Linux Audit API corner of the internet, where we make log lines safe and cute ✨

---

🌸 NAME 🌸

audit_encode_nv_string — encode a name/value pair in a string

---

🎀 SYNOPSIS 🎀

#include <libaudit.h>

char *audit_encode_nv_string(const char *name, const char *value, unsigned int vlen)"

---

✨ DESCRIPTION ✨

so basically, this function formats a name/value pair for logging by the audit system. periodt.

you should be using this on any field you're logging that might contain a space, a double-quote, a C0 control byte, a DEL byte, or a non-ASCII byte. values with those bytes in them have to be specially encoded so the auparse library can correctly handle the value. the encoding method is designed to prevent log injection attacks where malicious values could cause parsing errors 💀 (yes, that's a real threat, no cap).

to use it, you pass the name string and value string in their respective arguments, bestie:

• the name argument must not be NULL, and it gets copied as-is right before the = separator.
• the value gets checked with audit_value_needs_encoding(3).

if encoding is needed, the returned string has the form name=HEX, where HEX is the uppercase hexadecimal encoding of the value bytes. if encoding is not needed, the returned string has the form name=value. slay 💅

some lil' edge cases, since i know you like the details:

• if value is NULL, a question mark is used as the value. ❓
• if vlen is 0, the function uses strlen(3) to determine the value length.
• if the value may contain an embedded NUL byte, pass the value length in vlen bytes. (yes, in bytes, keep up 🫶)

⚠️ also be aware that the name of the field will cause auparse to do certain things when interpreting the value. if the name is uid, a user id value in decimal is expected. make sure that well known names are used for their intended purpose, or that there is no chance of name collision with something new. fr fr, don't be out here inventing name collisions, it's not the vibe 🙈

---

👑 RETURN VALUE 👑

returns a freshly malloc'ed string that the caller must free, or NULL on error. (and yes bestie, you have to free it — the main character energy here is on you 💖)

---

🌈 SEE ALSO 🌈

• audit_log_user_message(3)
• audit_log_user_comm_message(3)
• audit_log_user_avc_message(3)
• audit_log_semanage_message(3)
• audit_encode_value(3)
• audit_value_needs_encoding(3)

---

💜 AUTHOR 💜

Steve Grubb

---

and that's the whole thing, gorgeous 🦋 this one's brought to you by Red Hat, dated May 2026, and it lives in section 3 of the manual like the icon it is. go forth and encode responsibly, bestie 🎀✨