selinux_audit_rule_init(9)

💖 selinux_audit_rule_init(9) 💖

okay bestie, welcome to the Kernel API Manual entry for selinux_audit_rule_init(9) — it’s giving “tiny but important kernel helper,” and we’re gonna read it together. 💅

🌸 NAME 🌸

selinux_audit_rule_init — alloc/init an selinux audit rule structure.

✨ SYNOPSIS ✨

int selinux_audit_rule_init (u32 field , u32 op , char *rulestr , void
       **rule , gfp_t gfp );

🎀 ARGUMENTS 🎀

• field — the field this rule refers to.
• op — the operator the rule uses.
• rulestr — the text "target" of the rule.
• rule — pointer to the new rule structure returned via this.
• gfp — GFP flag used for kmalloc.

💅 DESCRIPTION 💅

Returns 0 if successful, -errno if not. On success, the rule structure will be allocated internally. The caller must free this structure with selinux_audit_rule_free after use.

bestie, do not forget the cleanup: selinux_audit_rule_free is your post-use bestie. ✨

🦋 SEE ALSO 🦋

• Kernel file ./security/selinux/include/audit.h
• selinux_audit_rule_avc_callback(9)
• selinux_audit_rule_free(9)
• selinux_audit_rule_match(9)
• selinux_audit_rule_known(9)

xoxo, your kernel bestie — from ./security/selinux/include, dated October 2026, on the selinux_audit_rule_init(9) page 💖🫶