AUDIT_LOG_USER_COMMAND(3)

πŸ“¦
version 4.2.1 Β· 2 versions
, in alpine 3.23, alpine 3.24, arch rolling, centos-stream 10, fedora 43, fedora 44, nixpkgs unstable, ubuntu resolute, ubuntu stonking

πŸ’– AUDIT_LOG_USER_COMMAND(3) πŸ’–

okay bestie, welcome to the AUDIT_LOG_USER_COMMAND page, part of the Linux Audit API ✨ this is literally the manual page you're looking for, and we're gonna get through it together, no cap 🫢


🌸 NAME 🌸

audit_log_user_command β€” log a user command πŸ’…


✨ SYNOPSIS ✨

#include <libaudit.h>

int
audit_log_user_command(intaudit_fd,int"type,constchar*"command,constchar*"tty,int"result);"

(yes, that's the signature exactly as the page gives it β€” we do not editorialize on the classics πŸ’€)


πŸŽ€ DESCRIPTION πŸŽ€

okay so. this function logs a command to the audit system using a predefined message format. it encodes the command the way the audit system expects for untrusted strings, which is the whole point β€” don't be out here hand-rolling your own encoding, bestie, that's how you get got 😭

this function should be used by all apps that need to record commands. all of them. every single one. periodt πŸ‘‘

now let's do the function parameters, one by one, because they all matter:

  • audit_fd β€” the fd returned by audit_open πŸŽ€
  • type β€” type of message, ex: AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN πŸ¦‹
  • command β€” the command being logged πŸ“
  • tty β€” the tty of the user; if NULL it will attempt to figure it out πŸ”
  • result β€” 1 is "success" and 0 is "failed" βœ… / ❌

🌈 RETURN VALUE 🌈

it returns the sequence number, which is > 0 on success or <= 0 on error. that's the vibe check right there πŸ’«


πŸ’€ ERRORS πŸ’€

this function returns -1 on failure. go examine errno for more info, bestie β€” it's holding all the answers πŸ™ˆ


πŸ‘‘ SEE ALSO πŸ‘‘

go read those too, they're iconic πŸ’œ


πŸ’– AUTHOR πŸ’–

Steve Grubb β€” legend, honestly, we stan 🫢


that's the whole page, bestie!! this one came from Red Hat back in Feb 2007, and it's the Linux Audit API's very own AUDIT_LOG_USER_COMMAND(3) πŸŽ€ log those commands responsibly, and I'll see you in the next man page βœ¨πŸ’…πŸ¦‹