__audit_syscall_exit(9)

💅 NAME 💅

okay so __audit_syscall_exit(9) — from the Kernel API Manual, bestie — is literally the deallocate audit context after a system call moment. 🫶

💖 SYNOPSIS 💖

void __audit_syscall_exit (int success , long return_code );

🎀 ARGUMENTS 🎀

• success — the success value of the syscall.
• return_code — the return value of the syscall.

🦋 DESCRIPTION 🦋

This function is the cleanup era 💅. It tears down after a system call.

If the audit context has been marked as auditable — either because of the AUDIT_STATE_RECORD state from filtering, or because some other part of the kernel wrote an audit message — then it writes out the syscall information.

In call cases (yes, “call,” that’s the original’s wording 😭), it frees the names stored from getname.

🌈 SEE ALSO 🌈

Kernel file ./kernel/auditsc.c, plus the whole squad:

• __audit_filter_op(9)
• audit_filter_uring(9)
• audit_reset_context(9)
• audit_alloc(9)
• audit_log_uring(9)
• __audit_free(9)
• audit_return_fixup(9)
• __audit_uring_entry(9)
• __audit_uring_exit(9)
• __audit_syscall_entry(9)
• __audit_getname(9)
• __audit_inode(9)
• __audit_inode_child(9)
• auditsc_get_stamp(9)
• __audit_mq_open(9)
• __audit_mq_sendrecv(9)
• __audit_mq_notify(9)
• __audit_mq_getsetattr(9)
• __audit_ipc_obj(9)
• __audit_ipc_set_perm(9)
• __audit_socketcall(9)
• __audit_fd_pair(9)
• __audit_sockaddr(9)
• audit_signal_info_syscall(9)
• __audit_log_bprm_fcaps(9)
• __audit_log_capset(9)
• audit_core_dumps(9)
• audit_seccomp(9)

okay bye bestie 🫶 — this page’s source is ./kernel, dated October 2026, and the page name is __audit_syscall_exit(9). periodt. 💅