audit_signal_info_syscall(9)

💅 audit_signal_info_syscall(9) — Kernel API Manual 💅

okay bestie, welcome to the Kernel API Manual page for this absolute icon: audit_signal_info_syscall. It’s giving syscall signal-info recording, and we’re gonna read it together. No cap.

💖 NAME 💖

audit_signal_info_syscall — record signal info for syscalls

✨ SYNOPSIS ✨

int audit_signal_info_syscall (struct task_struct *t );

🎀 ARGUMENTS 🎀

• t — the task being signaled. That’s the whole cast list, bestie.

🦋 DESCRIPTION 🦋

So here’s the vibe: if the audit subsystem is being terminated, this records the task (pid) and the uid that is doing that. Literally that’s the whole story. Short, sweet, iconic.

🌈 SEE ALSO 🌈

The kernel file ./kernel/auditsc.c is right there, plus the whole audit function friend group. Obsessed with this lineup:

• __audit_filter_op(9)
• audit_filter_uring(9)
• audit_reset_context(9)
• audit_alloc(9)
• audit_log_uring(9)
• __audit_free(9)
• audit_return_fixup(9)
• __audit_uring_entry(9)
• __audit_uring_exit(9)
• __audit_syscall_entry(9)
• __audit_syscall_exit(9)
• __audit_getname(9)
• __audit_inode(9)
• __audit_inode_child(9)
• auditsc_get_stamp(9)
• __audit_mq_open(9)
• __audit_mq_sendrecv(9)
• __audit_mq_notify(9)
• __audit_mq_getsetattr(9)
• __audit_ipc_obj(9)
• __audit_ipc_set_perm(9)
• __audit_socketcall(9)
• __audit_fd_pair(9)
• __audit_sockaddr(9)
• __audit_log_bprm_fcaps(9)
• __audit_log_capset(9)
• audit_core_dumps(9)
• audit_seccomp(9)

mwah 💋 this little masterpiece lives in ./kernel, dated October 2026, and it’s audit_signal_info_syscall(9) signing off. 🫶