AUDIT_LOG_USER_AVC_MESSAGE(3)

πŸ“¦
version 4.2.1 Β· 3 versions
, in alpine 3.23, alpine 3.24, arch rolling, centos-stream 10, fedora 43, fedora 44, nixpkgs unstable, ubuntu resolute, ubuntu stonking

πŸ’– AUDIT_LOG_USER_AVC_MESSAGE(3) πŸ’–

okay so bestie, we're in the Linux Audit API section of the manual, and today's main character is audit_log_user_avc_message πŸŽ€ she lives in libaudit and she is literally the girl who files the report.


✨ NAME ✨

audit_log_user_avc_message β€” log a user avc message πŸ¦‹


🌸 SYNOPSIS 🌸

#include <libaudit.h>

int
audit_log_user_avc_message(intaudit_fd,int"type,constchar*"message,constchar*"hostname,constchar*"addr,constchar*"tty,uid_t"auid);"
not me copying that signature exactly as the page has it πŸ’€ yes the spacing/quoting is giving typo energy, but we do not edit the sacred text, periodt.

πŸ’… DESCRIPTION πŸ’…

So here's the vibe: this function logs a message to the audit system using a predefined message format ✨ no cap. And who should be using her? all apps that are SE Linux object managers β€” like, if that's you, this is your girl, you're not doing it any other way πŸ’β€β™€οΈ

The function parameters are as follows:

  • audit_fd β€” the fd returned by audit_open πŸ”‘
  • type β€” type of message, ex: AUDIT_USER_AVC
  • message β€” the message being sent πŸ“¨
  • hostname β€” the hostname if known
  • addr β€” the network address of the user 🌐
  • tty β€” the tty of the user, if NULL will attempt to figure out πŸ–₯️
  • auid β€” the auid of the person related to the avc message

These values should correspond to who the message is about. πŸ‘‘ like, keep it accurate, the audit log is not a place for guessing games.


🫢 RETURN VALUE 🫢

She returns the sequence number, which is > 0 on success or <= 0 on error. slay. ✨


😭 ERRORS 😭

This function returns -1 on failure. Examine errno for more info β€” go look, bestie, the answer is in there πŸ”


🌈 SEE ALSO 🌈

the whole friend group, honestly πŸ’œ


⭐ AUTHOR ⭐

Steve Grubb πŸ‘‘


and that's the page!! source/version situation: Red Hat, Oct 2006, and the manual page name is AUDIT_LOG_USER_AVC_MESSAGE(3) β€” mwah, iconic, no notes πŸ’…βœ¨πŸ’–