audit_syscall_exit
Prev | Chapter 15. Audit Interfaces | Next

## Name

audit_syscall_exit — deallocate audit context after a system call

## Synopsis

`void audit_syscall_exit (` | int | valid,
| long | return_code`)`;

## Arguments

`valid`

  success/failure flag

`return_code`

  syscall return value

## Description

Tear down after system call. If the audit context has been marked as auditable (either because of the AUDIT_RECORD_CONTEXT state from filtering, or because some other part of the kernel write an audit message), then write out the syscall information. In call cases, free the names stored from `getname`.

Prev | Up | Next
audit_syscall_entry | Home | __audit_getname