kauditd_thread(9)

💖 kauditd_thread(9) — like, the whole vibe 💖

okay so bestie, welcome to the Kernel API Manual ✨ this one's a function page, and it's honestly kinda iconic in a quiet, does-its-job way. no cap.

---

✨ NAME ✨

kauditd_thread — the worker thread whose entire personality is sending audit records to userspace 🫶 genuinely the backbone of audit delivery, and it never asks for credit.

---

🌸 SYNOPSIS 🌸

int kauditd_thread (void *dummy );

---

🎀 ARGUMENTS 🎀

• dummy — unused. that's it. that's the whole argument. it's giving "we're contractually obligated to match the thread function signature" 💀 it does nothing, and honestly? respect.

---

🦋 SEE ALSO 🦋

the group chat of related symbols — no gatekeeping here, she tags everyone 💅

there's the kernel file, bestie: ./kernel/audit.c — that's where the lore lives 👑

and then, like, the entire extended friend group:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

like, that's the whole kauditd social circle. iykyk 🌈

---

bestie moment: the synopsis and the argument list are the entire documented interface here — no options, no return-value essay, no environment variables. this page is short and she is thriving 🧚 don't go inventing behaviours that aren't on the page, fr fr.

---

okay so that's the whole page!! mwah 💋 this little worker thread comes from the ./kernel source tree, and this particular writeup is dated ✨ October 2026 ✨ in the Kernel API Manual. slay, go read the rest of the audit fam 🍓💜