__audit_filter_op(9)

📦 version 7.3.1, in nixpkgs unstable

💅 __audit_filter_op — Kernel API Manual 🎀

okay so welcome to the group chat for __audit_filter_op(9) 💖 this is the Kernel API Manual page, and it's lowkey one of those little helper functions that everything else leans on — main character energy but make it a filter helper, iykyk ✨

🌸 NAME 🌸

__audit_filter_op — the common filter helper for operations, like, of the syscall/uring/etc variety 🦋 bestie it's the shared brain cell for op filtering, no cap.

✨ SYNOPSIS ✨

int __audit_filter_op (struct task_struct *tsk , struct audit_context
*ctx , struct list_head *list , struct audit_names *name , unsigned long
op );

literally just one function, one return value, five arguments — she's tidy 💅

🫶 ARGUMENTS 🫶

  • tsk — the associated task 👑 the task_struct in question, the whole reason we're here.
  • ctx — the audit context 🎀 your audit_context, carrying the state.
  • list — the audit filter list ⭐ the list of filters we're gonna run against.
  • name — the audit_name — and yes gorg, this one can be NULL 🙈 it's the only one with that privilege.
  • op — the current syscall/uring_op 🔥 i.e. which operation we're checking.

💖 DESCRIPTION 💖

So what she does: run the udit filters specified in list against tsk, using ctx, name, and op, as necessary 🧚 (and yeah the manpage literally spells it <italic>udit</italic> — that's a typo bestie, it means audit filters, but I'm keeping the receipt 😭).

⚠️ now the important part, don't skip this: the caller is responsible for ensuring that the call is made while the RCU read lock is held. That's on you, not on her. She will not hold it for you, she will not check, she will simply assume. 😭💀

The name parameter can be NULL — that's fine, we love a flexible queen — but all the others must be specified. No leaving tsk, ctx, list, or op on read, periodt 🌈

Return vibes 🎀: returns 1/true if the filter finds a match 💖, 0/false if none are found 🫶 — that's it, that's the whole personality.

👑 SEE ALSO 👑

Kernel file ./kernel/auditsc.c — plus the whole friend group, they all live together in the same file fr fr:

and that's the page!! 🦋 this lil slice of the Kernel API Manual dropped October 2026 out of the ./kernel tree 🎀 go hold that RCU read lock bestie, mwah 💜🌸

— __audit_filter_op(9) ✨

📦 where this page comes from