__audit_sockaddr(9)

📦 version 7.3.1, in nixpkgs unstable

💅 __audit_sockaddr — a Kernel API Manual moment

okay so bestie, welcome to the Kernel API Manual entry for __audit_sockaddr, and yes we are reading kernel docs together, this is our bonding time 🫶

✨ NAME ✨

__audit_sockaddr — record audit data for sys_bind, sys_connect, sys_sendto

like literally it's the little note-taker that writes down the address stuff when those syscalls go down 📝

🎀 SYNOPSIS 🎀

int __audit_sockaddr (int len , void *a );

that's the whole thing. two args. very demure, very mindful 💅

🌸 ARGUMENTS 🌸

  • len — data length in user space. yep, user space. that's where the length lives 🦋
  • a — data address in kernel space. and this one's in kernel space. they're in different spaces, it's giving long distance 😭

👑 DESCRIPTION 👑

so what happens? it returns 0 for success, or NULL context, or < 0 on error. that's the vibe check: zero good, everything else not it 🙈

no cap, NULL context is listed right there alongside the < 0 error case — don't come for me, I'm just reading the source 💀

🔥 SEE ALSO 🔥

Kernel file ./kernel/auditsc.c, plus literally the whole friend group:

and that's the page!! 🧚✨ shoutout to the ./kernel source for hosting this icon, dated October 2026, and to __audit_sockaddr(9) itself for being the main character of this whole doc 💖 mwah, bye bestie 🎀

📦 where this page comes from