1AUDIT_SYSCALL_EXIT(9)          Audit Interfaces          AUDIT_SYSCALL_EXIT(9)
2
3
4

NAME

6       audit_syscall_exit - deallocate audit context after a system call
7

SYNOPSIS

9       void audit_syscall_exit(int valid, long return_code);
10

ARGUMENTS

12       valid
13           success/failure flag
14
15       return_code
16           syscall return value
17

DESCRIPTION

19       Tear down after system call. If the audit context has been marked as
20       auditable (either because of the AUDIT_RECORD_CONTEXT state from
21       filtering, or because some other part of the kernel write an audit
22       message), then write out the syscall information. In call cases, free
23       the names stored from getname.
24

26Kernel Hackers Manual 2.6.       November 2011           AUDIT_SYSCALL_EXIT(9)
Impressum