matches_auditlog(9)

✨ NAME ✨

Okay so matches_auditlog is here to check the audit log for a network access denial — that’s the whole vibe. And yes bestie, this is the matches_auditlog(9) page from the Kernel API Manual, so you know it’s official. 💖

🌸 SYNOPSIS 🌸

The signature is exactly this, no cap:

int matches_auditlog (const int audit_fd , const char *const blockers ,
       const char *const dir_addr , const char *const addr , const char *const
       dir_port , const __u16 port );

🎀 ARGUMENTS 🎀

Here’s the cast of arguments, and every single one matters. No skipping, periodt. 💅

• const int audit_fd — the audit file descriptor. That’s the fd, iykyk. 🎀
• const char *const blockers — a regex-escaped blocker string, e.g. "net.bind_tcp". It’s already regex-escaped, so don’t come for me. ✨
• const char *const dir_addr — either "saddr" or "daddr". It gets ignored if addr is NULL. Literally those are the two options. 👑
• const char *const addr — a regex-escaped IP address string, or NULL. Main character energy right here. 🌟
• const char *const dir_port — either "src" or "dest". It gets ignored if addr is NULL. Yep, same rule. 🦋
• const __u16 port — a port number. It gets ignored if addr is NULL. That’s the tea, fr fr. 🍓

👀 SEE ALSO 👀

• Kernel file ./tools/testing/selftests/landlock/net_test.c — go look, bestie. 🔥

kay bye bestie 🫶 — source/version: ./tools/testing/selftests/land..., dated October 2026. mwah 💋✨