AUDIT_FGETS(3)

💖 AUDIT_FGETS 💖

okay bestie, welcome to AUDIT_FGETS(3) — yes it's a real Linux Audit API page and yes it's lowkey iconic. these are the buffered line reader helpers, and honestly? they're giving "fgets but make it descriptors." 🦋

---

✨ NAME ✨

audit_fgets, audit_fgets_more, audit_fgets_eof, audit_fgets_clear — buffered line reader helpers 🎀

---

✨ SYNOPSIS ✨

#include <libaudit.h>

int audit_fgets(char *buf, size_t blen, int fd);
int audit_fgets_more(size_t blen);
int audit_fgets_eof(void);
void audit_fgets_clear(void);

periodt. four little functions, one big vibe. 💅

---

✨ DESCRIPTION ✨

so here's the tea. 🌸

• audit_fgets reads from fd into buf, up to blen bytes or all the way through the next newline — whichever comes first. the text gets accumulated across calls in an internal buffer, so complete lines can be returned to you like little gifts. 🎁 and yes, the string is NUL terminated, we're not animals.
• audit_fgets_more checks whether the buffer holds a newline, or at least blen - 1 bytes. basically it's the "do we have enough yet??" check. 👀
• audit_fgets_eof tells you whether end of file was reached on fd. it's the "are we done here" indicator, no cap.
• audit_fgets_clear resets the internal buffer and the EOF state, discarding any stored text. it's giving factory reset but make it cute. ✨

🚨 important vibe check: these functions maintain static state and are therefore not thread safe. so like, don't be messy with them across threads, bestie. 😭

---

✨ RETURN VALUE ✨

• audit_fgets returns -1 on error, 0 when no data is available, or otherwise the number of characters copied. three moods fr fr.
• audit_fgets_more and audit_fgets_eof return 1 for true and 0 for false. simple, clean, slay.
• audit_fgets_clear returns no value. it just does the thing. 💅

---

✨ BACKGROUND ✨

okay so WHY does this whole family of functions even exist?? 🧐

the reason is that in auditd plugins, the event stream is stdin, which is descriptor 0. a typical pattern is to call select, poll, or epoll to wait for a record to arrive — and as soon as it does, you need to read it. ⚡

but if you use fgets, you will wind up with big problems, because you cannot mix low level descriptors with high level constructs like struct FILE. it's giving oil and water. 💀

this family of functions lets you correctly work only using descriptors, but with the convenience of fgets. best of both worlds, main character energy. 👑

---

✨ SEE ALSO ✨

• fgets(3) — the OG. the blueprint. the moment. 🌈

---

and that's the whole page, bestie!! written by the lovely folks at Red Hat, dated May 2025, and filed under AUDIT_FGETS(3) in section 3 of your friendly neighborhood manual. 🫶✨ mwah, go read some lines. 💖