__audit_syscall_entry(9)

📦 version 7.3.1, in nixpkgs unstable

✨ __audit_syscall_entry(9) ✨

okay so bestie, we're deep in the Kernel API Manual today and this one is literally the bouncer at the club door of every syscall 💅 buckle up.

🌸 NAME 🌸

__audit_syscall_entry — fill in an audit record at syscall entry 🎀

🦋 SYNOPSIS 🦋

void __audit_syscall_entry (int major , unsigned long a1 , unsigned long
a2 , unsigned long a3 , unsigned long a4 );

💖 ARGUMENTS 💖

  • major — the major syscall type (function), the main character of the syscall world 👑
  • a1 — additional syscall register 1
  • a2 — additional syscall register 2
  • a3 — additional syscall register 3
  • a4 — additional syscall register 4

four whole registers, she's stacked 🫶

🌈 DESCRIPTION 🌈

So here's the tea ☕: this function fills in the audit context at syscall entry. That's it, that's the job. But — and this is the important part, ngl — it only happens if the audit context was created back when the task was created, and the state or filters are actually demanding that the audit context be built. no context, no entry, no record, periodt 💀

And then there's the state check, okay? If the state — whether it comes from the per-task filter or from the per-syscall filter — is AUDIT_STATE_RECORD, then the record gets written at syscall exit time. yes bestie, exit, not entry, stay with me 😭

otherwise, it will only be written if another part of the kernel requests that it be written. so like, not automatically. somebody else has to ask. iykyk ✨

🎀 SEE ALSO 🎀

Kernel file ./kernel/auditsc.c — plus the whole friend group, fr fr:

and that's the whole page, bestie — no cap, we kept every single one of those 28 references 💖

okay so this absolute icon of a page lives in ./kernel and it's dated October 2026 — slay, era-defining, we love a timestamped queen 👑✨ 🦋💜

📦 where this page comes from