audit_seccomp(9)

📦 version 7.3.1, in nixpkgs unstable

💅 audit_seccomp(9) — a Kernel API Manual moment 🎀

okay so bestie, welcome to audit_seccomp(9), straight out of the Kernel API Manual ✨ this one's short and sweet and honestly kind of iconic — it's the little function that makes sure your seccomp drama gets recorded, no cap 💖

✨ NAME ✨

audit_seccomp — record information about a seccomp action 🦋

like, the whole vibe is "write down what seccomp just did" and honestly? slay.

🌸 SYNOPSIS 🌸

void audit_seccomp (unsigned long syscall , long signr , int code );

look at her. three args. no return value. main character energy 👑

🎀 ARGUMENTS 🎀

  • syscall — the syscall number 💫 like, which syscall are we even talking about bestie
  • signr — the signal value 🫶 the signal number, that's it, that's the whole vibe
  • code — the seccomp action 🌈 the actual action being reported

💜 DESCRIPTION 💜

Record the information associated with a seccomp action. periodt. that's the job 💅

okay so here's the tea — event filtering for seccomp actions that are not meant to be logged? that's handled over in seccomp_log, not here. so this function is out here forcing auditing to happen independent of the audit_enabled state and the dummy context state 😤 because seccomp actions should be logged even when audit is not in use. like, the whole point. no notes. 🔥

⚠️ real talk: it forces auditing — it doesn't politely ask. that's the design, bestie, it's giving "I don't need permission" 💀

🦋 SEE ALSO 🦋

so bestie, if you want the whole audit-verse, it's literally all hanging out in the kernel file ./kernel/auditsc.c 🧚 go read these:

that's a whole friend group right there, iykyk 😭💖

okay that's the page!! tysm for reading bestie 🫶 this little drop came to you from ./kernel, dated October 2026, and it's filed under audit_seccomp(9) — mwah, go log something 💋⭐

📦 where this page comes from