__audit_log_capset(9)

📦 version 7.3.1, in nixpkgs unstable

💅 __audit_log_capset(9) — like, the Kernel API Manual, bestie ✨

okay so real talk, we're in section 9 of the Kernel API Manual and this page is about one tiny little function that's doing the most important behind-the-scenes work. no cap, she's a keeper 🫶

🌸 NAME 🌸

__audit_log_capset — the function that literally stores the info about the args to the capset syscall, so the audit system can spill the tea later 💖

🎀 SYNOPSIS 🎀

void __audit_log_capset (const struct cred *new , const struct cred *old );

that's it. that's the whole vibe. two pointers, no return value, no drama ✨

🦋 ARGUMENTS 🦋

  • new — the new credentials. the glow-up version, the after pic 👑
  • old — the old (current) credentials. the before pic, the "it's giving legacy" era 🙈

⭐ DESCRIPTION ⭐

So basically, this function records the arguments that userspace sent to sys_capset — like, it's jotting it all down in the group chat so the audit system can print it out later if applicable. she's not the main character here, she's the bestie holding the receipts 🧚 and honestly? iconic behaviour.

no filtering, no judging, just recording. periodt. 💅

🔥 SEE ALSO 🔥

Kernel file ./kernel/auditsc.c — plus literally her entire friend group:

all of them. every single one. the whole squad ate, no crumbs left 🌈

okay bestie, that's the whole page — from ./kernel 💜, dated October 2026, and she's serving __audit_log_capset(9) realness until the very last line. mwah 🍓✨

📦 where this page comes from