__audit_socketcall(9)

💖 __audit_socketcall — NAME 💖

okay so bestie, this is a page from the Kernel API Manual (section 9, kernel developer land 🧚) and it's about __audit_socketcall — the function that records audit data for sys_socketcall ✨. that's the whole vibe. it logs stuff. for audit. for socketcalls. periodt 💅

✨ SYNOPSIS ✨

int __audit_socketcall (int nargs , unsigned long *args );

like, that's literally it. that's the signature. look at her go 🎀

🫶 ARGUMENTS 🫶

• nargs — the number of args, and listen, this one has a limit: it should not be more than AUDITSC_ARGS. that's not a suggestion, bestie, respect the ceiling 💀
• args — the args array. just... the array of args. it's giving "what it says on the tin" 🍓

🌈 SEE ALSO 🌈

first things first, the kernel file this lives in: ./kernel/auditsc.c 👑

and then the whole friend group, no cap:

• __audit_filter_op(9)
• audit_filter_uring(9)
• audit_reset_context(9)
• audit_alloc(9)
• audit_log_uring(9)
• __audit_free(9)
• audit_return_fixup(9)
• __audit_uring_entry(9)
• __audit_uring_exit(9)
• __audit_syscall_entry(9)
• __audit_syscall_exit(9)
• __audit_getname(9)
• __audit_inode(9)
• __audit_inode_child(9)
• auditsc_get_stamp(9)
• __audit_mq_open(9)
• __audit_mq_sendrecv(9)
• __audit_mq_notify(9)
• __audit_mq_getsetattr(9)
• __audit_ipc_obj(9)
• __audit_ipc_set_perm(9)
• __audit_fd_pair(9)
• __audit_sockaddr(9)
• audit_signal_info_syscall(9)
• __audit_log_bprm_fcaps(9)
• __audit_log_capset(9)
• audit_core_dumps(9)
• audit_seccomp(9)

and that's the whole page, babe 🦋 this lil cutie came from the source tree at ./kernel, dated October 2026, and it's filed under __audit_socketcall(9) in the Kernel API Manual — go read the whole squad up there, iykyk 💜✨