aa_audit_file(9)

🎀 aa_audit_file(9) 🎀

okay so bestie, this page is from the Kernel API Manual and it is literally about handling the auditing of file operations. no cap, it's giving kernel-security main character energy.

✨ NAME ✨

aa_audit_file — handle the auditing of file operations

🌸 SYNOPSIS 🌸

int aa_audit_file (const struct cred *subj_cred , struct aa_profile *profile , const struct aa_perms *perms , const char *op , u32 request , const char *name , const char *target , struct aa_label *tlabel , kuid_t ouid , const char *info , int error );

🧚 ARGUMENTS 🧚

• subj_cred — cred of the subject 💖
• profile — the profile being enforced (NOT NULL) 👑
• perms — the permissions computed for the request (NOT NULL) ✨
• op — operation being mediated
• request — permissions requested
• name — name of object being mediated (MAYBE NULL)
• target — name of target (MAYBE NULL)
• tlabel — target label (MAY BE NULL)
• ouid — object uid
• info — extra information message (MAYBE NULL)
• error — 0 if operation allowed else failure error code 💅

💅 RETURN 💅

0 or error on failure — that's the whole vibe check 🫶

🦋 SEE ALSO 🦋

bestie, go peek at the Kernel file ./security/apparmor/file.c and these icons: file_audit_cb(9), aa_lookup_condperms(9), aa_str_perms(9), aa_path_perm(9), xindex_is_subset(9), aa_path_link(9), aa_file_perm(9). 🌈

mwah 💋 signing off from ./security/apparmor with the October 2026 date, bestie 🎀