aa_audit(9)

💅 aa_audit(9) — bestie's guide to the Kernel API Manual ✨

okay so picture this: you're deep in the kernel, AppArmor is doing its thing, and something audit-worthy just happened. This little function is the one that logs it 🎀

---

🌸 NAME 🌸

aa_audit — literally logs a profile based audit event straight to the audit subsystem. no cap, that's the whole job 💖

---

✨ SYNOPSIS ✨

int aa_audit (int type , struct aa_profile *profile , struct apparmor_audit_data *ad , void (*cb) (struct audit_buffer *, void *) );

---

🦋 ARGUMENTS 🦋

• type — the audit type for the message. it's giving "what kind of event is this" energy 🏷️
• profile — the profile you're checking against. this one is NOT NULL, so don't even try it 🙈
• ad — the audit event itself. also NOT NULL, bestie, these two are non-negotiable ✋
• cb — an optional callback fn for the type specific fields. MAYBE NULL — it's giving flexible queen 👑

---

🌈 DESCRIPTION 🌈

handles the default message switching based off of the audit mode flags ✨ so like, depending on which flags are set, the message gets built differently — and this function is the main character doing that switching 🫶

---

🔥 RETURN 🔥

returns an error on failure. that's it, that's the tea 💀

---

👑 SEE ALSO 👑

• the kernel file ./security/apparmor/audit.c
• audit_pre(9)
• aa_audit_msg(9)

---

aaaand that's a wrap, bestie 🧚 from ./security/apparmor, in the very iconic month of October 2026 — this page is aa_audit(9), and honestly? she ate 💅⭐🍓