__audit_inode(9)

📦 version 7.3.1, in nixpkgs unstable

💅 __audit_inode — Kernel API Manual, but make it make sense ✨

okay so bestie, this is a page from the Kernel API Manual and it's about __audit_inode(9) — the little function that's out here storing the inode and device from a lookup. that's it, that's the whole personality. no cap 🎀

🌸 NAME 🌸

__audit_inode — store the inode and device from a lookup 💖

like literally what it says on the tin: it's holding onto the inode + device info that came out of a lookup, and it's doing that for the audit trail. icon behavior, honestly.

🦋 SYNOPSIS 🦋

void __audit_inode (struct filename *name , const struct dentry *dentry
, unsigned int flags );

it returns void btw, so don't be out here waiting for a return value that's never coming 🙈

✨ ARGUMENTS ✨

  • name — the struct filename * that's being audited, aka the name of the thing we're looking at 🎀
  • dentry — the const struct dentry * that's being audited, the dentry in question 💅
  • flags — an unsigned int holding the attributes for this particular entry, so like, the vibes of this specific one ⭐

💜 SEE ALSO 💜

the whole friend group, and yes they all ate 🔥 — straight from the kernel file ./kernel/auditsc.c:

ok that's the whole page, go touch some grass and then come back and read your audit logs 🌈

sign-off time 🫶 this little masterpiece lives in ./kernel, it's dated October 2026, and it goes by __audit_inode(9) — iykyk 💖✨🌸

📦 where this page comes from