audit_pre(9)

💅 audit_pre(9) — Kernel API Manual, but make it make sense 💅

okay bestie, welcome to the audit_pre(9) page. It’s giving “tiny kernel function, very important energy,” and we’re gonna get through it together 🫶

---

✨ NAME ✨

audit_pre — core AppArmor function. That’s the name, that’s the vibe, no notes 💖

---

🌸 SYNOPSIS 🌸

void audit_pre (struct audit_buffer *ab , void *va );

---

🎀 ARGUMENTS 🎀

• ab — the audit buffer to fill, and it is NOT NULL (so do not play with that one, bestie 🙈).
• va — the audit structure containing the data to audit, also NOT NULL (non-negotiable ✨).

---

🦋 DESCRIPTION 🦋

Record common AppArmor audit data from va. That’s the whole assignment, and it ate 💅

---

🌈 SEE ALSO 🌈

Kernel file ./security/apparmor/audit.c — also go peek at aa_audit_msg(9) and aa_audit(9), iykyk 👑

---

source/version vibe: ./security/apparmor, dated October 2026, and yes the page is audit_pre(9) — mwah, bye bestie 💋🎀