avc_audit_pre_callback(9)

💖 avc_audit_pre_callback(9) — like, the Kernel API Manual page, bestie 💖

Okay so real talk: this is a page from the Kernel API Manual for avc_audit_pre_callback ✨ — and yes, the (9) is part of the name, it's giving "section nine, kernel club only" energy 💅

---

🌸 NAME 🌸

avc_audit_pre_callback — the SELinux-specific info gets called by the generic audit code 🎀

Periodt. That's the whole vibe — this function is the SELinux bestie that the generic audit machinery rings up when it needs the good stuff 💖

---

✨ SYNOPSIS ✨

void avc_audit_pre_callback (struct audit_buffer *ab , void *a );

Note the spaces before those commas — we're keeping it exactly as written, no cap 🫶

---

🦋 ARGUMENTS 🦋

• ab — the audit buffer 💌 (that's where the audit-y stuff lives)
• a — audit_data 🌈

That's it, that's the whole cast of characters 😭 two arguments, both iconic in their own way 👑

---

🔥 SEE ALSO 🔥

Kernel file ./security/selinux/avc.c — like, the main character source file, go read it iykyk 💅

And the whole friend group, all in (9):

• avc_init(9)
• avc_lookup(9)
• avc_insert(9)
• avc_audit_post_callback(9)
• avc_add_callback(9)
• avc_update_node(9)
• avc_flush(9)
• avc_ss_reset(9)
• avc_compute_av(9)
• avc_perm_nonode(9)
• avc_has_perm_noaudit(9)
• avc_has_perm(9)

💀 friendly reminder: avc_audit_pre_callback(9) and avc_audit_post_callback(9) are two different girlies. Pre comes before, post comes after. Don't mix them up bestie 🙈

---

🧚 Sign-off 🧚

So this page lives under ./security/selinux 🌸 and it's dated October 2026 ⭐ — and obviously the manual name is still avc_audit_pre_callback(9) because we never forget the header 💜

Slay, go audit something responsibly 🔥👑💖