audit_receive(9)

✨ audit_receive — like, the manual page bestie ✨

Okay so this is audit_receive(9) from the Kernel API Manual, and honestly? It's a little one, but she's important. She's the one who answers the door when the netlink control socket has mail 💌

---

🌸 NAME 🌸

audit_receive — receive messages from a netlink control socket

Like literally, that's her whole job. She gets messages. From a netlink control socket. Iconic of her, honestly 👑

---

🦋 SYNOPSIS 🦋

void audit_receive (struct sk_buff *skb );

One function, one argument, zero drama. She returns void, so don't go looking for a return value, there isn't one, bestie 💅

---

🎀 ARGUMENTS 🎀

• skb — the message buffer. That's it. That's the whole argument list. She takes the buffer and she deals with it 🫶

---

💖 DESCRIPTION 💖

So what actually happens? She parses the skb you handed her, and she deals with any messages that may be present in it. Whatever's in there, she's on it.

And if the skb turns out to be malformed? She just discards it. No error, no drama, no "not me" moment — malformed skbs get dropped and she moves on. Lowkey ruthless but honestly valid 💀

---

🔥 SEE ALSO 🔥

Bestie, this is the long part. She rolls with a lot of people. The whole friend group lives in the kernel file ./kernel/audit.c, and here's everyone she wants you to know about:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

Yes, that's the whole roster. Go say hi to some of them 💜

---

Quick vibe check: this page lives in ./kernel, and it's dated October 2026. Mark your calendar, bestie 🗓️✨

Anyway, that's the tea on audit_receive(9) — she receives, she parses, she discards the malformed ones, and she does it all with main character energy. Slay 🎀🦋💖