audit_log_subj_ctx(9)

💖 audit_log_subj_ctx — the Kernel API Manual, bestie edition 💖

okay so this is a page from the Kernel API Manual (section 9, kernel-space functions, iykyk) and honestly? it's a tiny little function with main character energy. let's get into it 🫶

---

🌸 NAME 🌸

audit_log_subj_ctx — literally just add LSM subject information ✨ no cap, that's the whole gig.

---

🦋 SYNOPSIS 🦋

int audit_log_subj_ctx (struct audit_buffer *ab , struct lsm_prop *prop
);

it returns an int, takes two args, and honestly the line break before the closing paren is giving "wrote this at 3am" 💀 but we respect it.

---

🎀 ARGUMENTS 🎀

• ab — an audit_buffer, aka the thing we're writing into. your canvas, your aesthetic, your ✨audit buffer✨.
• prop — LSM subject properties. this is the actual tea we're pouring into the buffer, bestie.

---

💅 DESCRIPTION 💅

so what does it do? it adds a subj= field — and if it's necessary, it also adds an AUDIT_MAC_TASK_CONTEXTS record. that's it. that's the whole vibe check. lowkey iconic in its simplicity 👑

---

🌈 SEE ALSO 🌈

okay this list is long long, so buckle up, we're going through all of it (yes, all of it, we don't skip):

• Kernel file ./kernel/audit.c — the source file, the mothership 🏠
• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

like… the whole audit subsystem showed up to the party and honestly? slay 💀🔥

---

ngl bestie, if you're deep in the audit logs, this whole little family of functions is your new hyperfixation. go read them. i'll wait 🍓

---

✨ cute sign-off time ✨ — this page lives at ./kernel, and the version/date on the tin is October 2026. so yeah, slightly time-travelled documentation, but we stan a forward-thinking manpage 💜🧚 periodt.