audit_cb(9)

💅 audit_cb(9) 💅

okay so this page is from the Kernel API Manual, and it's giving “tiny callback, very specific job” energy. let's get into it, bestie 🫶

✨ NAME ✨

audit_cb — call back for mount specific audit fields. periodt.

🌸 SYNOPSIS 🌸

void audit_cb (struct audit_buffer *ab , void *va );

🦋 ARGUMENTS 🦋

• ab — an audit_buffer, and it is NOT NULL. literally no cap, it has to be there.
• va — the audit struct to audit values of, and it is also NOT NULL. yes bestie, both of them are required.

👑 SEE ALSO 👑

• Kernel file ./security/apparmor/mount.c — plus match_mnt_flags(9), match_mnt_path_str(9), and match_mnt(9). go check those if you're deep in the mount-audit lore 🔥

🫶 xoxo bestie — source/version: ./security/apparmor, date: October 2026. audit_cb(9) signing off 💅