audit_receive_filter(9) apply all rules to the specified message type

SYNOPSIS

int audit_receive_filter(int type, int pid, int uid, int seq, void * data, size_t datasz, uid_t loginuid, u32 sessionid, u32 sid);

ARGUMENTS

type

audit message type

pid

target pid for netlink audit messages

uid

target uid for netlink audit messages

seq

netlink audit message sequence (serial) number

data

payload data

datasz

size of payload data

loginuid

loginuid of sender

sessionid

sessionid for netlink audit message

sid

SE Linux Security ID of sender

COPYRIGHT