AUDIT_GET_SESSION(3)

💖 AUDIT_GET_SESSION 💖

okay bestie, gather round, we're doing libaudit today and honestly? this one is a little cutie. it's audit_get_session, a member of the Linux Audit API, and it's here to hand you a program's login session id. no cap. 🎀

---

🌸 NAME 🌸

audit_get_session — get a program's login session id value 💅

---

✨ SYNOPSIS ✨

#include <libaudit.h>

uint32_t audit_get_session(void);

like, that's the whole thing. no arguments. she takes nothing and gives you a number. main character energy fr. 👑

---

🦋 DESCRIPTION 🦋

so basically, this function returns the task's session id attribute. that's it. that's the tea. ☕✨

---

💀 RETURN VALUE 💀

here's where it gets a lil spicy, so pay attention bestie:

• if the session id was set, you get the session id value back. slay. 🎉
• if the session id is unset, it will return a -1. BUT — and this is the plot twist — the return type is uint32_t, which is an unsigned type. so instead of seeing -1 like a normal human, you will see the converted value instead. 😭 it's giving "technically correct but emotionally confusing."

not me getting a giant number when I wanted a -1 🙈 that's just how unsigned math works, babes.

---

🔥 ERRORS 🔥

okay so, failure mode check:

• this function returns -2 on failure. yes, a whole different number. -2, not -1. iconic, honestly. 💅
• additionally, in the event of a real error, errno would be set.
• the function can set errno based on failures of open, read, or strtoul. so if one of those three is having a bad day, errno is gonna tell you about it.

so if you see -2, something actually broke. if you see the converted giant number, nothing broke — the session id is just unset. different vibes entirely. 🫶

---

🌈 SEE ALSO 🌈

• audit_getloginuid(3) — her sister function, go say hi 🦋

---

👑 AUTHOR 👑

Steve Grubb — thank you for your service, king 🫡💖

---

that's the whole page bestie, go forth and audit responsibly. ✨

this lil writeup came to you from Red Hat, dated Dec 2016, and it's the AUDIT_GET_SESSION(3) page from the Linux Audit API family. mwah, bye! 💋🌸🎀