audit_iface(9)

🎀 audit_iface(9) — the kernel API manual, bestie edition 💅

okay so real talk: this is a page from the Kernel API Manual, and the star of the show is audit_iface(9) — the little function that handles the audit message for policy unpacking / load / replace / remove. yes, all four. she contains multitudes. ✨

---

✨ NAME ✨

audit_iface — do the audit message for policy unpacking/load/replace/remove. that's literally her job description and she's iconic for it 🫶

---

🌸 SYNOPSIS 🌸

int audit_iface (struct aa_profile *new , const char *ns_name , const
char *name , const char *info , struct aa_ext *e , int error );

she takes six arguments. six! main character energy fr fr 👑

---

🦋 ARGUMENTS 🦋

• new — the profile, but only if it's actually been allocated. it MAYBE NULL, so like… check before you vibe with it 🙈
• ns_name — the name of the ns the profile is getting loaded to. MAY BE NULL, no pressure 💜
• name — the name of the profile that's being manipulated. MAYBE NULL bestie, it's optional 🎀
• info — any extra info about the failure. MAYBE NULL, but like… spill the tea if you have it ☕
• e — buffer position info. yes that's vague, that's what the page says, moving on 💅
• error — the error code 🔥

---

⭐ RETURN ⭐

0 or error. that's it. that's the whole return section. iconic minimalism ngl 🧚

---

🌈 SEE ALSO 🌈

the kernel file lives at ./security/apparmor/policy_unpack.c, and the squad — the whole friend group, no one left out 💖:

• aa_unpack_u16_chunk(9)
• aa_unpack_nameX(9)
• unpack_dfa(9)
• unpack_strs_table(9)
• unpack_profile(9)
• verify_header(9)
• verify_dfa_accept_index(9)
• verify_profile(9)
• aa_unpack(9)

---

ngl if you got this far you actually read the whole page and that's so hot of you 🫶 go read the source next, iykyk

---

and that's a wrap!! this page came from ./security/apparmor and is dated October 2026 — put it in your calendar, bestie, she's got a date 🎀✨💜