AUDIT_GET_FEATURES(3)

💖 AUDIT_GET_FEATURES(3) 💖

okay bestie, we're in the Linux Audit API section of the manual and today's topic is audit_get_features and audit_set_feature — aka query or change kernel audit features ✨ like, the kernel's got a whole feature menu and these two functions are how you peek at it or tweak it. no cap.

🌸 NAME 🌸

audit_get_features, audit_set_feature — literally just: query or change kernel audit features 🫶

✨ SYNOPSIS ✨

#include <libaudit.h>

uint32_t audit_get_features(void);
int audit_set_feature(int fd, unsigned feature, unsigned value, unsigned
lock);"

yes that's the whole vibe. two functions, one header, we move 💅

🦋 DESCRIPTION 🦋

audit_get_features()

she returns a bitmap describing which kernel audit features are supported 🎀 the way this works is: the bitmap is cached internally and retrieved from the kernel on the first call. so the first time you ask, the kernel answers; after that, it's just vibes from the cache. iconic behavior, honestly.

audit_set_feature()

this one changes a feature bit for the kernel, using the descriptor fd — and heads up, fd must be an open audit netlink socket, no exceptions bestie 🚨

• feature selects the bit to modify 👑
• if value is nonzero the feature is enabled, otherwise it is disabled 🫡
• if lock is nonzero the feature setting is locked until reboot 🔒 (yes, until reboot. that's a commitment. choose wisely.)

💀 the feature bits currently defined 💀

• AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT — kernel supports changing the backlog queue depth 📚
• AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME — kernel supports delaying syscalls when the queue is full ⏳
• AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH — kernel will include the executable path on EXECVE records 🛣️
• AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND — exclude rules may be used with more fields than just message type 👀
• AUDIT_FEATURE_BITMAP_SESSIONID_FILTER — session identifier filtering is supported 🪪
• AUDIT_FEATURE_BITMAP_LOST_RESET — allows resetting the lost event counter 🔄
• AUDIT_FEATURE_BITMAP_FILTER_FS — kernel supports file system field filtering 🗂️

🎀 RETURN VALUE 🎀

• audit_get_features returns the feature bitmap, or 0 if feature queries are unsupported 😭
• audit_set_feature returns <= 0 on error, otherwise it's the netlink sequence id number ✨

🌈 SEE ALSO 🌈

audit_request_features(3), audit_reset_lost(3), audit_open(3). go read those too, they're the friend group 🫶

👑 AUTHOR 👑

Steve Grubb — the main character who wrote this, we stan 💜

fr fr, this whole page is Red Hat's, dated July 2025, so if you're citing it: Red Hat, July 2025. periodt. 💅🌸✨