audit_delete_rule(3) - Linux man page

Name

audit_delete_rule - Delete auditing rule

Synopsis

#include <libaudit.h>

int audit_delete_rule (int fd, struct audit_rule *rule, int flags, int action);

Description

audit_delete_rule uses the function audit_send to delete an existing rule for auditing. audit_delete_rule stores flags and action in the audit_rule structure and then makes a call to audit_send (fd, AUDIT_DEL, rule, sizeof(*rule)). Possible values for flags are:

• AUDIT_PER_TASK

• AUDIT_AT_ENTRY

• AUDIT_AT_EXIT

Possible values for action are:

• AUDIT_NEVER

• AUDIT_POSSIBLE

• AUDIT_ALWAYS

Return Value

The return value is equal to the return value from audit_send.

Examples

/* Sample code */
flags=AUDIT_PER_TASK;
action=AUDIT_ALWAYS;
audit_delete_rule(fd, &rule, flags, action);

See Also

audit_send(3), audit_add_rule(3), auditctl(8).

Author

Debora Velarde.

Referenced By