kauditd_rehold_skb(9)

💅 kauditd_rehold_skb(9) — Kernel API Manual, bestie edition 🎀

okay so picture this: you're deep in the kernel API manual (iconic, honestly), and you've stumbled into kauditd_rehold_skb ✨ lowkey a little niche, highkey important if you're the audit queue girlies. let's get into it 🦋

---

✨ NAME ✨

kauditd_rehold_skb — the function that handles it when an audit record's send fails and it's sitting in the hold queue 😭

---

🌸 SYNOPSIS 🌸

void kauditd_rehold_skb (struct sk_buff *skb , int error );

that's the whole signature, no cap 💅 it returns void, so don't go looking for a return value, there isn't one 🫶

---

🎀 ARGUMENTS 🎀

• skb — the audit record itself. yes, the whole struct sk_buff, the main character 📦👑
• error — an error code. and here's the gag: it's unused 🙈 literally just vibing there in the signature. respectful.

---

💖 DESCRIPTION 💖

so the way this works: kauditd_rehold_skb should only be used by the kauditd_thread when it fails to flush the hold queue 😭 like, this is not a general-purpose "call me whenever" situation, it's a specific little cleanup moment and it's for kauditd_thread alone. respect the boundaries fr fr 🔥

ngl bestie, "only be used by the kauditd_thread" is a real instruction, not a suggestion — keep this one in its lane or you're gonna have a bad time 💀

---

🦋 SEE ALSO 🦋

the whole friend group 🫶 — and also the kernel file they all live in:

Kernel file ./kernel/audit.c

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

---

and that's the page, bestie 🌈 you ate, you read the whole SEE ALSO list, I'm so proud 💜

sign-off szn: this little baddie comes from ./kernel 🍓, dated October 2026 ⭐, and it's filed under kauditd_rehold_skb(9) 🧚 go forth and handle those send failures, queen 👑💅