audit_buffer_aux_new(9)

📦 version 7.3.1, in nixpkgs unstable

💅 audit_buffer_aux_new(9) — like, the Kernel API Manual page, bestie 🎀

okay so this is a page from the Kernel API Manual and it's literally about audit_buffer_aux_new — the little function that makes aux records happen. it's giving "behind the scenes queen" energy tbh ✨

🌸 NAME 🌸

audit_buffer_aux_new — adds an aux record buffer to the skb list. that's it, that's the vibe 🫶

✨ SYNOPSIS ✨

int audit_buffer_aux_new (struct audit_buffer *ab , int type );

like, it takes two things and gives you back an int. slay 💅

🦋 ARGUMENTS 🦋

  • ab — the audit_buffer. she's the main character here, no cap 👑
  • type — the message type. yep, that's the whole description, it's a short one 🙈

💖 DESCRIPTION 💖

okay so here's what's actually going down. aux records get allocated and added to the skb list of the "main" record. periodt. 🎀

and the way that ab->skb works? on creation of the aux record, it gets reset to point at the aux record. so ab->skb is like "hi bestie, i'm the aux record now" ✨

BUT — when the aux record is complete, ab->skb has to be reset to point back to the "main" record. gotta put it back where it belongs, iykyk 💫

the whole point of this little dance? it lets the audit_log_ functions be completely ignorant of which kind of record they're logging to. they just do their thing, no thoughts head empty 🌸. and it also avoids having to add special data for aux records — which, honestly, iconic. no extra baggage 💅

on success, ab->skb will point to the new aux record. she returns 0 on success, and -ENOMEM if allocation fails. 💀 (that's the "memory said no" situation, happens to the best of us)

🌈 SEE ALSO 🌈

the kernel file ./kernel/audit.c, plus the whole friend group that comes with it:

like, that's the whole squad right there. go read them too, fr fr 🧚

ngl if this page was your first stop, maybe go peek at audit_buffer_aux_end(9) next since she's literally the counterpart. the two of them together? ate 🔥

and that's the page bestie!! source lives in ./kernel, this version is dated October 2026, and the whole thing is filed under Kernel API Manual audit_buffer_aux_new(9). mwah, go forth and audit 💜🌸✨

📦 where this page comes from