auditd_send_unicast_skb(9)

💌 auditd_send_unicast_skb(9) — like, the Kernel API Manual page, but make it make sense

okay so bestie, welcome to the auditd_send_unicast_skb(9) glow-up ✨ this one lives in the Kernel API Manual and honestly? she's a lil function with one job and a whole lot of lore. let's get into it 🫶

---

✨ NAME ✨

auditd_send_unicast_skb — the girl who sends a record via unicast to auditd 💅 no cap, that's the whole vibe.

---

🎀 SYNOPSIS 🎀

int auditd_send_unicast_skb (struct sk_buff *skb );

one function, one arg, returns an int. iconic, minimal, we respect it 💖

---

🦋 ARGUMENTS 🦋

• skb — the audit record itself, packaged up all cute in a struct sk_buff *. this is the thing you're yeeting over to auditd 🚀

---

🌸 DESCRIPTION 🌸

so basically: you hand this function an skb and it sends that thing to the audit daemon. it returns positive/zero values on success and negative values on failure — that's your vibe check on how it went 😌

and here's the part you cannot miss, bestie, because it's giving "read the terms and conditions":

in all cases the skb will be consumed by this function. like, always. every single case. no refunds, no take-backs, don't-you-dare-touch-it-afterwards 💀

more tea: if the send results in -ECONNREFUSED, the connection with auditd will be reset. so that's a whole thing that happens. 🔥

and the big one — this function may sleep, so callers should not hold any locks where this would cause a problem 😭 fr fr, do not be out here holding locks and then calling this. that's not main character energy, that's a deadlock arc. periodt.

---

👑 SEE ALSO 👑

the whole friend group 💜 all of these are (9) entries, and yes we're listing every single one because nobody gets left behind:

• Kernel file ./kernel/audit.c
• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

---

and that's the page!! 🎀✨ this lil baddie came out of ./kernel and is dated October 2026 — so yeah, mark your calendars bestie, the kernel API manual said what it said 💅🦋 go forth and send your unicast skbs responsibly, mwah 💖