AUDIT_LOG_USER_COMMAND(3)
π AUDIT_LOG_USER_COMMAND(3) π
okay bestie, welcome to the AUDIT_LOG_USER_COMMAND page, part of the Linux Audit API β¨ this is literally the manual page you're looking for, and we're gonna get through it together, no cap π«Ά
πΈ NAME πΈ
audit_log_user_command β log a user command π
β¨ SYNOPSIS β¨
#include <libaudit.h>
int
audit_log_user_command(intaudit_fd,int"type,constchar*"command,constchar*"tty,int"result);"
(yes, that's the signature exactly as the page gives it β we do not editorialize on the classics π)
π DESCRIPTION π
okay so. this function logs a command to the audit system using a predefined message format. it encodes the command the way the audit system expects for untrusted strings, which is the whole point β don't be out here hand-rolling your own encoding, bestie, that's how you get got π
this function should be used by all apps that need to record commands. all of them. every single one. periodt π
now let's do the function parameters, one by one, because they all matter:
audit_fdβ the fd returned byaudit_openπtypeβ type of message, ex:AUDIT_USYS_CONFIG,AUDIT_USER_LOGINπ¦commandβ the command being logged πttyβ the tty of the user; ifNULLit will attempt to figure it out πresultβ1is"success"and0is"failed"β / β
π RETURN VALUE π
it returns the sequence number, which is > 0 on success or <= 0 on error. that's the vibe check right there π«
π ERRORS π
this function returns -1 on failure. go examine errno for more info, bestie β it's holding all the answers π
π SEE ALSO π
audit_log_user_message(3)audit_log_user_comm_message(3)audit_log_acct_message(3)audit_log_user_avc_message(3)audit_log_semanage_message(3)
go read those too, they're iconic π
π AUTHOR π
Steve Grubb β legend, honestly, we stan π«Ά
that's the whole page, bestie!! this one came from Red Hat back in Feb 2007, and it's the Linux Audit API's very own AUDIT_LOG_USER_COMMAND(3) π log those commands responsibly, and I'll see you in the next man page β¨π
π¦
π¦ where this page comes from
- alpine 3.23: audit-doc 4.1.2-r2 Β· LGPL-2.1-or-later
- alpine 3.24: audit-doc 4.1.2-r6 Β· LGPL-2.1-or-later
- arch rolling: audit 4.2.1-1 Β· GPL-2.0-or-later AND LGPL-2.0-or-later
- centos-stream 10: audit-libs-devel 4.2.1-3.el10 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.1.1-2.fc43 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.1.1-2.fc43 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.2.1-1.fc43 Β· LGPL-2.0-or-later
- fedora 43: audit-libs-devel 4.2.1-1.fc43 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.1.4-1.fc44 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.1.4-1.fc44 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.2.1-1.fc44 Β· LGPL-2.0-or-later
- fedora 44: audit-libs-devel 4.2.1-1.fc44 Β· LGPL-2.0-or-later
- nixpkgs unstable: audit 4.2.1
- ubuntu resolute: libaudit-dev 1:4.1.2-1build1 Β· GPL-2.0-only
- ubuntu resolute: libaudit-dev 1:4.1.2-1ubuntu0.1 Β· GPL-2.0-only
- ubuntu stonking: libaudit-dev 1:4.1.2-1ubuntu1 Β· GPL-2.0-only
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms