file_audit_cb(9)

💅 file_audit_cb — like, the manual page, in the Kernel API Manual btw

okay so bestie, welcome to the Kernel API Manual ✨ and today's main character is file_audit_cb(9). she's a callback. she handles the file-specific audit fields. that's the whole vibe. 🎀

---

✨ NAME ✨

file_audit_cb — the call back for file specific audit fields 🦋

like fr, that's her job description, no cap.

---

🌸 SYNOPSIS 🌸

void file_audit_cb (struct audit_buffer *ab , void *va );

look at her. two params. zero drama. she takes them exactly like that, spacing and all, so don't you dare retype it "cleaner" 💀

---

🔥 ARGUMENTS 🔥

• ab — an audit_buffer, and it is NOT NULL 🙈 (capital letters, bestie, they're not playing around)
• va — the audit struct you want the audit values of, also NOT NULL 👑 (yep, same energy, no nulls allowed here)

ngl the "NOT NULL" on both is lowkey the whole personality of this function. respect it. 🫶

---

💖 SEE ALSO 💖

the friend group 🧚 — go say hi:

• Kernel file ./security/apparmor/file.c aa_audit_file(9)
• aa_lookup_condperms(9)
• aa_str_perms(9)
• aa_path_perm(9)
• xindex_is_subset(9)
• aa_path_link(9)
• aa_file_perm(9)

it's giving squad goals, honestly 🌈

---

and that's the page!! 🍓 brought to you by the fine folks hanging out in ./security/apparmor, dated October 2026, and yeah — file_audit_cb(9), that's her name, don't wear it out ✨💜 periodt.