avc_audit(9)

💖 avc_audit(9) — Kernel API Manual 💖

okay so this is the glow-up of the avc_audit page, bestie. It’s from the Kernel API Manual, and it’s literally about auditing permissions. Periodt.

🌸 NAME 🌸

avc_audit — Audit the granting or denial of permissions. That’s the whole vibe: it audits whether permissions get granted or denied. No cap.

✨ SYNOPSIS ✨

int avc_audit (u32 ssid , u32 tsid , u16 tclass , u32 requested , struct
       av_decision *avd , int result , struct common_audit_data *a );

The return type is int, bestie. The signature is giving “I take a bunch of IDs and decisions and I audit them” energy.

🎀 ARGUMENTS 🎀

• ssid — source security identifier. Like, the security ID for the source, obvi.
• tsid — target security identifier. The security ID for the target. Slay.
• tclass — target security class. The class of the target, exactly.
• requested — requested permissions. The permissions being asked for, fr fr.
• avd — access vector decisions. The decisions live here, iconic.
• result — result from avc_has_perm_noaudit. Not me stressing that exact source, but yes, that’s where it comes from.
• a — auxiliary audit data. Extra audit data, the supporting character.

🦋 DESCRIPTION 🦋

Audit the granting or denial of permissions in accordance with the policy. Okay so it’s doing the audit based on the policy, no cap.

This function is typically called by avc_has_perm after a permission check, but it can also be called directly by callers who use avc_has_perm_noaudit in order to separate the permission check from the auditing. The way that separation works is lowkey the whole point for those callers: permission check over here, auditing over there, bestie.

For example, this separation is useful when the permission check must be performed under a lock, to allow the lock to be released before calling the auditing code. Literally the lock can be released before the auditing code runs, and that’s why this split is useful. Main character energy for lock hygiene, honestly.

💅 SEE ALSO 💅

• Kernel file ./security/selinux/include/avc.h — that’s the reference path, bestie. Go look if you need the header vibes. 💖

🎀 okay bye bestie! this page is avc_audit(9) from the Kernel API Manual; source/version: ./security/selinux/include; Kernel file: ./security/selinux/include/avc.h; date: October 2026. it ate, no cap. 💅✨