STRUCT AUDITD_CONNECTION(9)

🎀 struct auditd_connection — kernel/auditd connection state 🎀

Okay so bestie, welcome to struct auditd_connection(9) from the Kernel API Manual ✨ this is the little guy that holds the vibe of the kernel ↔ auditd situationship, and I'm gonna walk you through it line by line, no cap 💅

---

🌸 NAME 🌸

struct auditd_connection — literally the kernel/auditd connection state 🫶 that's it, that's the whole name, she's self-explanatory and iconic for it 👑

---

✨ SYNOPSIS ✨

Here's our girl in all her glory — copy her exactly, don't be weird about the whitespace 🙈

struct auditd_connection {
    struct pid *pid;
    u32 portid;
    struct net *net;
    struct rcu_head rcu;
 };

---

💖 Members 💖

Four members, all baddies, all essential 😭

• pid — the auditd PID 🎀 yes, the actual process ID of auditd, she's got a name and a number
• portid — the netlink portid 📡 it's a u32, it's a port id, it's giving netlink energy
• net — the associated network namespace 🌐 the netns this whole situation lives in
• rcu — the RCU head ⭐ the little hook that makes the whole RCU thing work, we love her

---

🦋 Description 🦋

So here's the important part and I need you to listen, bestie 🙈

This struct is RCU protected; you must either hold the RCU lock for reading or the associated spinlock for writing 🚨

That's not a suggestion, that's the whole rule 😤 read = RCU lock, write = associated spinlock, pick one, don't freestyle. If you don't you're gonna have a bad time and the kernel will not be nice about it 💀

---

🌈 SEE ALSO 🌈

Okay this list is long and honestly kind of iconic — here's the whole fam 🫶 first up, the literal source: Kernel file ./kernel/audit.c 📁

struct audit_net(9), struct audit_ctl_mutex(9), auditd_test_task(9), audit_ctl_lock(9), audit_ctl_unlock(9), audit_ctl_owner_current(9), auditd_pid_vnr(9), audit_cfg_lsm(9), audit_get_sk(9), audit_log_lost(9), auditd_conn_free(9), auditd_set(9), kauditd_printk_skb(9), kauditd_rehold_skb(9), kauditd_hold_skb(9), kauditd_retry_skb(9), auditd_reset(9), auditd_send_unicast_skb(9), kauditd_send_queue(9), kauditd_thread(9), audit_send_reply(9), audit_receive(9), audit_serial(9), audit_log_start(9), audit_expand(9), audit_log_format(9), audit_log_n_hex(9), audit_string_contains_control(9), audit_log_n_untrustedstring(9), audit_log_untrustedstring(9), audit_buffer_aux_new(9), audit_buffer_aux_end(9), audit_log_subj_ctx(9), audit_log_path_denied(9), audit_set_loginuid(9), audit_signal_info(9), __audit_log_end(9), audit_log_end(9), audit_log(9) — like, every single one, go read them, iykyk 📚🔥

---

and that's the whole page bestie, you ate that 💅 🎀 this one came from ./kernel and it's dated October 2026 ⭐ so if you're reading it in some other timeline, that's on you 😭 bye bestie, go hold that RCU lock 🦋🌸