audit_caps(9)

✨ NAME ✨

okay so bestie, this is audit_caps(9) from the Kernel API Manual, and it's literally the function that does one thing: audit a capability. that's the whole vibe. 💅

---

🌸 SYNOPSIS 🌸

int audit_caps (struct apparmor_audit_data *ad , struct aa_profile
*profile , int cap , int error );

like, that's the signature, no cap. copy it exactly, don't come for me. 🫶

---

🎀 ARGUMENTS 🎀

• ad — the audit data. it's giving "the receipts."
• profile — the profile being tested for confinement, and bestie it is NOT NULL. do not play with that. 😭
• cap — the capability that got tested.
• error — the error code returned by the test. slay, now we know what happened.

---

💖 DESCRIPTION 💖

okay so what this function actually does: it does the auditing of a capability, and it handles the audit/complain/kill modes switching, plus duplicate message elimination. periodt. that's the whole assignment, and it ate. ✨

no extra lore, no invented side quests — those are the facts and they're iconic.

---

🦋 RETURN 🦋

on success you get 0 or ad->error, and on failure you get an error code. simple as that, bestie. 🎀

---

🌈 SEE ALSO 🌈

• Kernel file ./security/apparmor/capability.c audit_cb(9), profile_capable(9), aa_capable(9) — yes, all of those, exactly like that. go read them, iykyk. 👑

---

ngl, if profile is NULL, that's not the move. the page literally says NOT NULL. consider this your vibe check. 💀

---

and that's the page, bestie — brought to you by ./security/apparmor and dated October 2026. mwah, go audit something cute. 💜🎀✨