kauditd_hold_skb(9)

💖 NAME 💖

okay so this is kauditd_hold_skb(9) from the Kernel API Manual, and it’s literally about queueing an audit record while waiting for auditd. 💅

kauditd_hold_skb — queue an audit record, waiting for auditd. ✨

🎀 SYNOPSIS 🎀

void kauditd_hold_skb (struct sk_buff *skb , int error );

🦋 ARGUMENTS 🦋

• skb — audit record. yes bestie, that’s the audit record in question 🫶
• error — error code. the code that says what went wrong 😭

🔥 DESCRIPTION 🔥

Queue the audit record, waiting for an instance of auditd. When this function is called, we haven’t given up yet on sending the record, but ngl things are not looking good. 😭 The first thing we want to do is try to write the record via printk, and then see if we want to try and hold on to the record and queue it — if we have room. If we want to hold on to the record, but we don’t have room, record a record lost message. 💀

So yeah: it’s giving “try printk first, then decide whether to hold and queue,” and if holding is the move but there’s no room, the record-lost message gets recorded. periodt. 💅

💜 SEE ALSO 💜

Kernel file ./kernel/audit.c — plus the whole squad: struct audit_net(9), struct auditd_connection(9), struct audit_ctl_mutex(9), auditd_test_task(9), audit_ctl_lock(9), audit_ctl_unlock(9), audit_ctl_owner_current(9), auditd_pid_vnr(9), audit_cfg_lsm(9), audit_get_sk(9), audit_log_lost(9), auditd_conn_free(9), auditd_set(9), kauditd_printk_skb(9), kauditd_rehold_skb(9), kauditd_retry_skb(9), auditd_reset(9), auditd_send_unicast_skb(9), kauditd_send_queue(9), kauditd_thread(9), audit_send_reply(9), audit_receive(9), audit_serial(9), audit_log_start(9), audit_expand(9), audit_log_format(9), audit_log_n_hex(9), audit_string_contains_control(9), audit_log_n_untrustedstring(9), audit_log_untrustedstring(9), audit_buffer_aux_new(9), audit_buffer_aux_end(9), audit_log_subj_ctx(9), audit_log_path_denied(9), audit_set_loginuid(9), audit_signal_info(9), __audit_log_end(9), audit_log_end(9), audit_log(9).

💖 cute sign-off: source/version ./kernel, dated October 2026 — bye bestie, go hold those records responsibly! 🌈🎀