audit_rule_change(9)

💅 NAME 💅

okay so bestie, welcome to audit_rule_change(9) from the Kernel API Manual ✨. This icon is literally here to apply all rules to the specified message type — that's the whole serve, no cap 💖.

🛠️ SYNOPSIS 🛠️

the signature is exactly this, character for character, don't come for me:

int audit_rule_change (int type , int seq , void *data , size_t datasz
);

🎀 ARGUMENTS 🎀

• type — the audit message type, periodt 💅.
• seq — the netlink audit message sequence (serial) number, iykyk 🦋.
• data — payload data, the actual payload bestie 🌸.
• datasz — size of payload data, AKA how much payload data there is 🔥.

🦋 SEE ALSO 🦋

the linked lore drops are literally:

• Kernel file ./kernel/auditfilter.c audit_list_rules_send(9), parent_len(9), audit_compare_dname_path(9) — all of it, bestie 💜.

and that's the whole page, bestie 🫶. source/version vibes: ./kernel, dated October 2026, and it's all about audit_rule_change(9) 💖✨.