audit_buffer_aux_end(9)

🎀 audit_buffer_aux_end — it's giving Kernel API Manual, bestie 🎀

okay so real talk, this one is a tiny little function page from the Kernel API Manual (audit_buffer_aux_end(9)) and honestly? she's short but she's iconic. let's get into it 💅

---

✨ NAME ✨

audit_buffer_aux_end — switch back to the "main" record from an aux record 🫶

like, you were off in aux-record land and now we're going home. main character energy restored, no cap.

---

✨ SYNOPSIS ✨

void audit_buffer_aux_end (struct audit_buffer *ab );

yes that's the whole thing. one function, one pointer, and the void up front means she does not return anything back to you. she just does her little job and leaves. 💜

---

✨ ARGUMENTS ✨

• ab — an audit_buffer. that's it, that's the whole parameter list. literally just the audit buffer. 🦋

---

✨ DESCRIPTION ✨

so basically this function restores the "main" audit record to ab->skb. ✨

that's the vibe check: whatever was going on with the aux record, we're flipping back so the "main" audit record is the one sitting in ab->skb again. skb lives in the audit_buffer you handed in, so yeah — that's the whole story. simple, clean, slay. 💖

---

✨ SEE ALSO ✨

bestie the cross-reference list here is long and I mean LONG, so buckle up. all of these live around the Kernel file ./kernel/audit.c:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

like, the whole audit girlie ecosystem is in here. obsess. 👑

---

and that's the page!! mwah 💋 this little writeup is from ./kernel, dated October 2026, and it's the audit_buffer_aux_end(9) page — so now you know her, and honestly? you should text her back. 🎀💖🌸