audit_get_sk(9)

💖 audit_get_sk(9) — a Kernel API Manual moment 💖

okay so bestie, welcome to audit_get_sk(9), straight out of the Kernel API Manual ✨ this one's short and sweet and honestly it's giving "small function, big responsibility" energy 🎀

---

🌸 NAME 🌸

audit_get_sk — returns the audit socket for the network namespace you handed it 🦋

---

⭐ SYNOPSIS ⭐

struct sock * audit_get_sk (const struct net *net );

like, that's the whole thing. one call, one arg, one pointer back 💅

---

🧚 ARGUMENTS 🧚

• net — the destination network namespace, aka the place you want the audit socket for 🌈

---

👑 DESCRIPTION 👑

so here's the vibe check: it returns the sock pointer if valid, and NULL otherwise 🫶 no cap, that's it.

but — and this is the part you cannot skip, bestie — the caller must ensure that a reference is held for the network namespace while the sock is in use 😭 like, you have to keep that namespace alive the whole time the sock is out here living its life. that's on you, not on the function. iykyk 💀

---

🔥 SEE ALSO 🔥

kernel file ./kernel/audit.c, plus the whole audit friend group, every single one of them, no skipped members periodt 👑

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

---

and that's the whole page, bestie, you ate that 🍓 before you go — this lil masterpiece lives in ./kernel, it's dated October 2026, and it goes by audit_get_sk(9) 💜 mwah, see you in the next manpage 💅✨