AUDIT_UPDATE_WATCH_PERMS(3)

💅 AUDIT_UPDATE_WATCH_PERMS 💅

okay bestie, gather round, because today we're talking about audit_update_watch_perms from the Linux Audit API — it's the little function that updates the permissions field of a watch command. lowkey iconic, highkey essential. ✨

---

✨ SYNOPSIS ✨

#include <libaudit.h>

int audit_update_watch_perms(struct audit_rule_data *rule,int"perms);"

(yes, that last line is exactly how it shows up in the original — we do not touch the lore, we only report it 🫶)

---

🌸 DESCRIPTION 🌸

So here's the tea: audit_update_watch_perms adds the permission checks to a watch command that is being built. That's it, that's the whole job, and it does it flawlessly. 💅

The perms you hand it? They're a bitwise or'ing of these four besties right here:

• AUDIT_PERM_EXEC
• AUDIT_PERM_WRITE
• AUDIT_PERM_READ
• AUDIT_PERM_ATTR

Stack 'em with | and let it cook. 🔥

---

🎀 RETURN VALUE 🎀

• Returns a number < 0 if an error occurs 😭
• otherwise, 0 for success 👑

periodt.

---

🦋 SEE ALSO 🦋

• audit_add_rule_data(3)
• audit_add_watch(3)

---

👑 AUTHOR 👑

Steve Grubb. a real one, no cap. 🫶

---

Red Hat · Feb 2007 · AUDIT_UPDATE_WATCH_PERMS(3)

and that's the whole page bestie, mwah 💖 slay, go update those watch perms responsibly 🌈⭐