syscall_get_arch(9)

💖 syscall_get_arch(9) 💖

okay so welcome to the Kernel API Manual page for this absolute little icon, bestie ✨

---

🌸 NAME 🌸

syscall_get_arch — return the AUDIT_ARCH for the current system call 🫶

---

✨ SYNOPSIS ✨

int syscall_get_arch (struct task_struct *task );

---

🎀 ARGUMENTS 🎀

• task — the task of interest, and bestie it must be blocked. no cap, that part matters 💅

---

🦋 DESCRIPTION 🦋

Okay so this returns the AUDIT_ARCH_* based on the system call convention in use. slay 💖

It's only valid to call this when task is stopped on entry to a system call, due to SYSCALL_WORK_SYSCALL_TRACE, SYSCALL_WORK_SYSCALL_AUDIT, or SYSCALL_WORK_SECCOMP. like, that is the vibe check, and if it fails, do not pass go 😭

Architectures which permit CONFIG_HAVE_ARCH_SECCOMP_FILTER must provide an implementation of this. periodt, that's the rule 👑

---

🌈 SEE ALSO 🌈

• Kernel file ./include/asm-generic/syscall.h
• syscall_get_nr(9)
• syscall_set_nr(9)
• syscall_rollback(9)
• syscall_get_error(9)
• syscall_get_return_value(9)
• syscall_set_return_value(9)
• syscall_get_arguments(9)
• syscall_set_arguments(9)

---

source/version: ./include/asm-generic · date: October 2026 · page: syscall_get_arch(9) — mwah, bye bestie 💋✨