auditd_set(9)

💅 auditd_set(9) — it's from the Kernel API Manual, bestie, and it's giving kernel-internals-core

okay so picture this: you're deep in the kernel, the audit daemon is being A Whole Thing, and somebody has to actually keep track of the connection state. That somebody is this function. Let's get into it 🫶

---

✨ NAME ✨

auditd_set — literally just "Set/Reset the auditd connection state". That's the whole vibe check, no cap.

---

🦋 SYNOPSIS 🦋

int auditd_set (struct pid *pid , u32 portid , struct net *net , struct
sk_buff *skb , bool *ack );

like. five arguments. iconic of her honestly 💅

---

🎀 ARGUMENTS 🎀

• pid — the auditd PID. yeah. that PID. the auditd one. 👑
• portid — the auditd netlink portid, aka where the netlink stuff actually points at 🦋
• net — a pointer to the auditd network namespace. yes it's a namespace pointer, and yes it matters, hold that thought for the DESCRIPTION
• skb — the netlink command coming in from the audit daemon itself, main character energy fr fr
• ack — the netlink ack flag, and here's the little detail bestie: it gets cleared if ack'd here 👀 so like, if this function handles the ack, that flag is getting zeroed out

---

🌸 DESCRIPTION 🌸

so what does she actually do? This function will obtain and drop network namespace references as necessary. that's it, that's the job — taking and releasing netns refs when it needs to, periodt ✨

Returns zero on success, negative values on failure. Very demure. Very standard. But don't get it twisted — failure is negative numbers, so always check 😭

ngl the description is short but that's genuinely all there is, use the SEE ALSO if you want the whole friend group

---

🌈 SEE ALSO 🌈

okay this is the most unhinged part of the whole page — the SEE ALSO list is HUGE and honestly ate. It's a kernel file plus a truly slay amount of sibling functions, so buckle up 💖

The kernel file we're living in: ./kernel/audit.c

Then the structs:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)

Then the city of functions, in order, no skips, no cuts 🧚:

• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

like?? that's the whole audit subsystem in one friend group chat. obsessed 🔥

---

and that's the page, bestie 💜 it lives in ./kernel, it's dated October 2026, and it goes by auditd_set(9) — go forth and manage that connection state, iykyk 🎀✨