smack_audit_rule_known(9)

📦 version 7.3.1, in nixpkgs unstable

💅 smack_audit_rule_known — the smack(9) kernel API manual, bestie edition

okay so this is the manual page for smack_audit_rule_known(9), from the Smack kernel API docs. yes it's a kernel function. yes it's niche. and yes we're gonna obsess over it anyway 💖

✨ NAME ✨

smack_audit_rule_known — the little function that distinguishes Smack audit rules 🎀

✨ SYNOPSIS ✨

int smack_audit_rule_known (struct audit_krule *krule );

✨ ARGUMENTS ✨

  • krule — the rule of interest, bestie 🫶 and it's in Audit kernel representation format, so like… the audit layer's own little outfit for it, not Smack's. noted 📝

✨ DESCRIPTION ✨

okay so picture this: there's a big pile of Audit rules and some of them are secretly ours. this function is the bouncer at the door 💅

It's used to filter Smack rules out from the remaining Audit ones. And if it's proved that this rule belongs to us — like, truly, genuinely ours, no cap — then the audit_rule_match hook gets called to do the final judgement. main character energy fr 🔥

that's literally it. small function, huge responsibility. periodt ⭐

✨ SEE ALSO ✨

buckle up buttercup, this list is long 😭 everything below lives in the kernel file ./security/smack/smack_lsm.c, and every single one of them is (9):

okay that's the whole squad, all 137 of them, every last one accounted for 😤🫶

ngl if you got to the bottom of that SEE ALSO list you deserve a little treat 🍓 we love a completionist.

and that's the page!! brought to you by the kernel file ./security/smack, dated October 2026, signing off — smack_audit_rule_known(9) out 💜🧚✨

📦 where this page comes from