getaudit(9)

✨ getaudit 💅

okay so bestie, welcome to getaudit — she's the read handler for the securityfs node, and that node is literally "ipe/success_audit". that's it, that's the whole vibe. she reads, she slays, she returns a length. 🎀

---

🌸 SYNOPSIS 🌸

ssize_t getaudit (struct file *f , char __user *data , size_t len ,
loff_t *offset );

no cap, that's the whole signature. copy it exactly, don't @ me. ✨

---

🦋 ARGUMENTS 🦋

• f — supplies a file structure representing the securityfs node. she's the main character of this whole operation fr fr 🫶
• data — supplies a buffer passed to the read syscall. this is where the reading actually happens, iykyk 💖
• len — supplies the length of data. yes bestie, size matters, this is literally how much room you're giving her 🌸
• offset — unused. not me pointing out that she's just sitting there, unused, iconic but doing nothing 😭💀

---

🔥 RETURN 🔥

the length of buffer written. that's it. that's the return value. periodt. 👑

---

⭐ SEE ALSO ⭐

• Kernel file ./security/ipe/fs.c — like, the actual source file, go read her 📖
• setaudit(9)
• setenforce(9)
• getenforce(9)
• new_policy(9)
• ipe_init_securityfs(9)

all of these are her friends, the whole squad, go say hi 🧚💜

---

ngl bestie, if you're here you probably want setaudit(9) instead — this one only reads. don't come for me, I'm just the messenger 🙈

---

and that's a wrap! 🌈 this whole page lives in ./security/ipe and it's dated October 2026 — yes, the future, because she's ahead of her time ⭐💅 bye bestie, go read some audit state 🎀