selinux_audit_rule_match(9)

💅 selinux_audit_rule_match(9) 💅

okay so bestie, we’re in the Kernel API Manual and this page is literally about selinux_audit_rule_match — the vibe check for whether a context ID matches a rule. no cap ✨

🌸 NAME 🌸

selinux_audit_rule_match — determine if a context ID matches a rule. 💖

✨ SYNOPSIS ✨

int selinux_audit_rule_match (struct lsm_prop *prop , u32 field , u32 op
       , void *rule );

🎀 ARGUMENTS 🎀

• prop — includes the context ID to check, bestie 🫶
• field — the field this rule refers to, periodt
• op — the operator the rule uses, slay 💅
• rule — pointer to the audit rule to check against 🔥

🦋 DESCRIPTION 🦋

Okay so the tea ☕: this one returns 1 if the context id matches the rule, 0 if it does not, and -errno on failure. That’s the whole plot — short and iconic 😭👑

🌈 SEE ALSO 🌈

• Kernel file ./security/selinux/include/audit.h
• selinux_audit_rule_avc_callback(9)
• selinux_audit_rule_init(9)
• selinux_audit_rule_free(9)
• selinux_audit_rule_known(9)

okay bestie, page over! this one came from ./security/selinux/include, dated October 2026, and the footer says selinux_audit_rule_match(9). mwah 💋🧚