1__AUDIT_SYSCALL_ENTR(9)        Audit Interfaces        __AUDIT_SYSCALL_ENTR(9)
2
3
4

NAME

6       __audit_syscall_entry - fill in an audit record at syscall entry
7

SYNOPSIS

9       void __audit_syscall_entry(int major, unsigned long a1,
10                                  unsigned long a2, unsigned long a3,
11                                  unsigned long a4);
12

ARGUMENTS

14       major
15           major syscall type (function)
16
17       a1
18           additional syscall register 1
19
20       a2
21           additional syscall register 2
22
23       a3
24           additional syscall register 3
25
26       a4
27           additional syscall register 4
28

DESCRIPTION

30       Fill in audit context at syscall entry. This only happens if the audit
31       context was created when the task was created and the state or filters
32       demand the audit context be built. If the state from the per-task
33       filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT, then the
34       record will be written at syscall exit time (otherwise, it will only be
35       written if another part of the kernel requests that it be written).
36

38Kernel Hackers Manual 3.10         June 2019           __AUDIT_SYSCALL_ENTR(9)
Impressum