GET_AUDITFAIL_ACTION(3)

💖 GET_AUDITFAIL_ACTION(3) 💖

okay bestie, welcome to the Linux Programmer's Manual, section 3, and today's main character is get_auditfail_action — the lil function that goes "hey, what do we do when the audit subsystem ghosts us?" 🫶

---

✨ NAME ✨

get_auditfail_action — literally just: get the failure_action tunable value. that's it. that's the whole job. 💅

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int get_auditfail_action(auditfail_t *failmode);

---

🦋 DESCRIPTION 🦋

so here's the vibe. this function goes and fetches the failure_action tunable value that's chillin' in /etc/libaudit.conf. 📁

the way you're supposed to use it: you call audit_open, it comes back with an error (😭 tragic, we know), and then you call get_auditfail_action to find out what action the admin actually prefers in that situation. like, the admin already decided, you just gotta go ask.

the failure_action value found in /etc/libaudit.conf gets copied into the failmode argument when the function returns. so then your calling application takes that value and uses it to figure out what to actually do when the audit subsystem is unavailable. no cap, that's the whole flow. 🔥

---

👑 RETURN VALUE 👑

• success — get_auditfail_action returns a zero, and failmode will be holding the failure_action value. slay. ✨
• the possible values for failure_action are:
  • FAIL_IGNORE (0)
  • FAIL_LOG (1)
  • FAIL_TERMINATE (2)
• failure — it returns a return code of one. 💀

---

🎀 ERRORS 🎀

you get an error back if either of these happens:

• there's an error reading /etc/libaudit.conf, or
• the failure_action tunable is not found in the file.

so if your config file is being mysterious or the tunable just isn't there? error. periodt. 🙈

---

🍓 EXAMPLES 🍓

here's the sample code, exactly as the elders wrote it:

/* Sample code */
auditfail_t failmode;

if ((fd = audit_open() ) < 0 ) {
     fprintf (stderr, "Cannot open netlink audit socket");

     /* Get the failure_action */
     if ((rc = get_auditfail_action(&failmode)) == 0) {
         if (failmode == FAIL_LOG)
              fprintf (stderr, "Audit subsystem unavailable");
         else if (failmode == FAIL_TERMINATE)
              exit (1);
         /* If failmode == FAIL_IGNORE, do nothing */
     }
}

see how it's doing the thing? socket didn't open, it yells about it, then checks what the admin wants: log it, terminate, or just vibe and do nothing. iconic behaviour honestly. 💜

---

🌈 SEE ALSO 🌈

• audit_open(3)
• auditd(8)

---

⭐ AUTHOR ⭐

Lisa M. Smith. 💖

---

and that's a wrap, bestie 🧚 — this little page came from the Linux 2.7 era, dated 2006-7-10. go forth and handle your audit failures with grace, no cap 💅🌸