audit_alloc(9)

📦 version 7.3.1, in nixpkgs unstable

🌸 audit_alloc(9) — the kernel API manual, bestie edition 🌸

okay so we're in section 9 of the kernel API manual today, and the star of the show is audit_alloc — say hi 👋

✨ NAME ✨

audit_alloc — allocate an audit context block for a task 💖

like, it's literally handing out the little audit-context gift bag for a task. iconic behavior.

🎀 SYNOPSIS 🎀

int audit_alloc (struct task_struct *tsk );

one function, one argument, no drama. slay.

🦋 ARGUMENTS 🦋

  • tsk — the task. that's it, that's the whole description. she's a struct task_struct * and she's the main character here 👑

🌈 DESCRIPTION 🌈

so what does she actually do? glad you asked 🫶

audit_alloc filters on the task information, and then — if it's necessary — it allocates a per-task audit context. no cap, that's the whole job.

and the moment that per-task audit context exists? boom, system call auditing is turned on for that specified task. 🔥 like, that's the switch-flip. that's the vibe check that says "yes, we're auditing this one."

also super important: this is called from copy_process, so no lock is needed. no lock bestie, we're built different. 💅

🌸 SEE ALSO 🌸

the whole friend group 💜 — go say hi to all of them, fr fr:

ok that's the whole page, bestie — every flag, every detail, nothing dropped. periodt. 💅✨

and a lil sign-off 🎀 — this one lives in ./kernel, it's dated October 2026, and it's filed under audit_alloc(9). bye pookie, see you in the next manpage 🦋💖

📦 where this page comes from