audit_send_reply(9)

💅 NAME

audit_send_reply — bestie, this one sends an audit reply message via netlink ✨

(also hi, welcome to the Kernel API Manual page for it, we're gonna have a time)

---

🎀 SYNOPSIS

void audit_send_reply (struct sk_buff *request_skb , int seq , int type
, int done , int multi , const void *payload , int size );

like it's literally right there, copy it exactly, don't @ me 🙈

---

🌸 ARGUMENTS

okay so every single one of these matters, no skipping:

• request_skb — the skb of the request we're replying to. it's literally used to target the reply, so like, it's the whole reason the reply knows where to go 💫
• seq — the sequence number. yes. that one.
• type — the audit message type, iconic little label energy
• done — the done (last) flag 🏁 like "this is the final one bestie"
• multi — the multi-part message flag, for when one message just isn't enough
• payload — the payload data, the actual goods
• size — the payload size, aka how much of the goods there is

---

🦋 DESCRIPTION

So what it does is: it allocates an skb, builds the netlink message, and sends it to the port id. that's the whole vibe. allocate, build, send, slay 💅✨

---

👑 SEE ALSO

the reading list, and I mean the whole reading list, no skimming:

• Kernel file ./kernel/audit.c
• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

---

that's the whole page bestie, go forth and reply to audits 🫶

mwah 💖 this has been audit_send_reply(9), living in ./kernel, dated October 2026 — ily, bye!! 🎀✨