audit_signal_info(9)

okay so bestie, welcome to audit_signal_info(9) from the Kernel API Manual — it's the tiny kernel-API page about recording who's doing the termination when the audit subsystem is shutting down. very niche, very specific, we love a focused queen 🎀

🌸 NAME 🌸

audit_signal_info — record signal info for shutting down audit subsystem. no cap, that's the whole name-card vibe 🫶

✨ SYNOPSIS ✨

int audit_signal_info (int sig , struct task_struct *t );

📥 ARGUMENTS 📥

• sig — signal value. the signal in question, keeping it cute and typed as int in the synopsis 💅
• t — task being signaled. this is the struct task_struct * bestie on the receiving end of the signal 🦋

💖 DESCRIPTION 💖

If the audit subsystem is being terminated, record the task (pid) and uid that is doing that. literally: when audit is getting terminated, this is the function that writes down which task's pid and which uid is doing the terminating. it's giving "bestie, log the culprit" energy 😭🔥

🔗 SEE ALSO 🔗

bestie, the audit squad is deep. the page points at Kernel file ./kernel/audit.c, plus all of these icons:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

Before you go, the footer tea: the source/version side is ./kernel, the date is October 2026, and the page title is audit_signal_info(9). mwah 💋✨