AUDIT_LOG_USER_AVC_MESSAGE(3)
π AUDIT_LOG_USER_AVC_MESSAGE(3) π
okay so bestie, we're in the Linux Audit API section of the manual, and today's main character is audit_log_user_avc_message π she lives in libaudit and she is literally the girl who files the report.
β¨ NAME β¨
audit_log_user_avc_message β log a user avc message π¦
πΈ SYNOPSIS πΈ
#include <libaudit.h>
int
audit_log_user_avc_message(intaudit_fd,int"type,constchar*"message,constchar*"hostname,constchar*"addr,constchar*"tty,uid_t"auid);"
not me copying that signature exactly as the page has it π yes the spacing/quoting is giving typo energy, but we do not edit the sacred text, periodt.
π DESCRIPTION π
So here's the vibe: this function logs a message to the audit system using a predefined message format β¨ no cap. And who should be using her? all apps that are SE Linux object managers β like, if that's you, this is your girl, you're not doing it any other way πββοΈ
The function parameters are as follows:
audit_fdβ the fd returned byaudit_openπtypeβ type of message, ex:AUDIT_USER_AVCmessageβ the message being sent π¨hostnameβ the hostname if knownaddrβ the network address of the user πttyβ the tty of the user, ifNULLwill attempt to figure out π₯οΈauidβ the auid of the person related to the avc message
These values should correspond to who the message is about. π like, keep it accurate, the audit log is not a place for guessing games.
π«Ά RETURN VALUE π«Ά
She returns the sequence number, which is > 0 on success or <= 0 on error. slay. β¨
π ERRORS π
This function returns -1 on failure. Examine errno for more info β go look, bestie, the answer is in there π
π SEE ALSO π
audit_log_user_message(3)audit_log_acct_message(3)audit_log_user_comm_message(3)audit_log_semanage_message(3)
the whole friend group, honestly π
β AUTHOR β
Steve Grubb π
and that's the page!! source/version situation: Red Hat, Oct 2006, and the manual page name is AUDIT_LOG_USER_AVC_MESSAGE(3) β mwah, iconic, no notes π
β¨π
π¦ where this page comes from
- alpine 3.23: audit-doc 4.1.2-r2 Β· LGPL-2.1-or-later
- alpine 3.24: audit-doc 4.1.2-r6 Β· LGPL-2.1-or-later
- arch rolling: audit 4.2.1-1 Β· GPL-2.0-or-later AND LGPL-2.0-or-later
- centos-stream 10: audit-libs-devel 4.2.1-3.el10 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.1.1-2.fc43 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.1.1-2.fc43 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.2.1-1.fc43 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.2.1-1.fc43 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.1.4-1.fc44 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.1.4-1.fc44 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.2.1-1.fc44 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.2.1-1.fc44 Β· LGPL-2.0-or-later
- nixpkgs unstable: audit 4.2.1
- ubuntu resolute: libaudit-dev 1:4.1.2-1build1 Β· GPL-2.0-only
- ubuntu resolute: libaudit-dev 1:4.1.2-1ubuntu0.1 Β· GPL-2.0-only
- ubuntu stonking: libaudit-dev 1:4.1.2-1ubuntu1 Β· GPL-2.0-only
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms