audit_expand(9)

✨ audit_expand(9) ✨

okay so bestie, we're in the Kernel API Manual today and this one's a little function called audit_expand — it literally just expands the skb in the audit buffer 💅 that's it, that's the whole vibe.

---

🌸 SYNOPSIS 🌸

int audit_expand (struct audit_buffer *ab , int extra );

like, she takes two things and she returns an int. simple queen behavior 👑

---

🎀 ARGUMENTS 🎀

• ab — an audit_buffer, yep, that's the one you're poking at 🫶
• extra — the space to add at the tail of the skb, i.e. how much more room you want tacked on the end ✨

---

💖 DESCRIPTION 💖

so here's the tea: she returns 0 on a failed expansion — and ngl, 0 here means no space, which is giving flop 😭 — or she returns the available space if it actually worked, which is giving main character energy 🔥

periodt. that's the whole description. short and iconic.

---

👑 SEE ALSO 👑

okay this list is LONG but we're not skipping anybody, everyone gets their moment 💜 the source of it all is the kernel file ./kernel/audit.c, and then:

struct audit_net(9), struct auditd_connection(9), struct audit_ctl_mutex(9), auditd_test_task(9), audit_ctl_lock(9), audit_ctl_unlock(9), audit_ctl_owner_current(9), auditd_pid_vnr(9), audit_cfg_lsm(9), audit_get_sk(9), audit_log_lost(9), auditd_conn_free(9), auditd_set(9), kauditd_printk_skb(9), kauditd_rehold_skb(9), kauditd_hold_skb(9), kauditd_retry_skb(9), auditd_reset(9), auditd_send_unicast_skb(9), kauditd_send_queue(9), kauditd_thread(9), audit_send_reply(9), audit_receive(9), audit_serial(9), audit_log_start(9), audit_log_format(9), audit_log_n_hex(9), audit_string_contains_control(9), audit_log_n_untrustedstring(9), audit_log_untrustedstring(9), audit_buffer_aux_new(9), audit_buffer_aux_end(9), audit_log_subj_ctx(9), audit_log_path_denied(9), audit_set_loginuid(9), audit_signal_info(9), __audit_log_end(9), audit_log_end(9), audit_log(9)

like, the whole audit friend group showed up to the function. iykyk 🦋

---

and that's the page, bestie!! this lil cutie lives in ./kernel and she got her glow-up in October 2026 🎀💅✨ go read your audit buffer, you're doing amazing, mwah 🫶