website-struct

Struct: audit_context

Status

Regular

• In 4.4: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 4.8: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 4.10: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 4.13: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 4.15: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 4.18: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.0: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.3: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.4: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.8: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_lsm;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.11: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_lsm;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.13: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_lsm;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.15: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_lsm;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 5.19: ✅

  struct audit_context {
      int dummy;
      enum (anon) context;
      enum audit_state state;
      enum audit_state current_state;
      struct audit_stamp stamp;
      int major;
      int uring_op;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_lsm;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct open_how openat2;
      struct (anon) execve;
      struct (anon) module;
      struct (anon) time;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 6.2: ✅

  struct audit_context {
      int dummy;
      enum (anon) context;
      enum audit_state state;
      enum audit_state current_state;
      struct audit_stamp stamp;
      int major;
      int uring_op;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_lsm;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct open_how openat2;
      struct (anon) execve;
      struct (anon) module;
      struct (anon) time;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 6.5: ✅

  struct audit_context {
      int dummy;
      enum (anon) context;
      enum audit_state state;
      enum audit_state current_state;
      struct audit_stamp stamp;
      int major;
      int uring_op;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_lsm;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct open_how openat2;
      struct (anon) execve;
      struct (anon) module;
      struct (anon) time;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In 6.8: ✅

  struct audit_context {
      int dummy;
      enum (anon) context;
      enum audit_state state;
      enum audit_state current_state;
      struct audit_stamp stamp;
      int major;
      int uring_op;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      struct lsmblob target_blob;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct open_how openat2;
      struct (anon) execve;
      struct (anon) module;
      struct (anon) time;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

Arch

• In arm64: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In armhf: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In ppc64el: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In riscv64: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

Flavor

• In aws: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In azure: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In gcp: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

• In lowlatency: ✅

  struct audit_context {
      int dummy;
      int in_syscall;
      enum audit_state state;
      enum audit_state current_state;
      unsigned int serial;
      int major;
      struct timespec64 ctime;
      long unsigned int argv[4];
      long int return_code;
      u64 prio;
      int return_valid;
      struct audit_names preallocated_names[5];
      int name_count;
      struct list_head names_list;
      char *filterkey;
      struct path pwd;
      struct audit_aux_data *aux;
      struct audit_aux_data *aux_pids;
      struct __kernel_sockaddr_storage *sockaddr;
      size_t sockaddr_len;
      pid_t pid;
      pid_t ppid;
      kuid_t uid;
      kuid_t euid;
      kuid_t suid;
      kuid_t fsuid;
      kgid_t gid;
      kgid_t egid;
      kgid_t sgid;
      kgid_t fsgid;
      long unsigned int personality;
      int arch;
      pid_t target_pid;
      kuid_t target_auid;
      kuid_t target_uid;
      unsigned int target_sessionid;
      u32 target_sid;
      char target_comm[16];
      struct audit_tree_refs *trees;
      struct audit_tree_refs *first_trees;
      struct list_head killed_trees;
      int tree_count;
      int type;
      struct (anon) socketcall;
      struct (anon) ipc;
      struct (anon) mq_getsetattr;
      struct (anon) mq_notify;
      struct (anon) mq_sendrecv;
      struct (anon) mq_open;
      struct (anon) capset;
      struct (anon) mmap;
      struct (anon) execve;
      struct (anon) module;
      int fds[2];
      struct audit_proctitle proctitle;
  };
  

Differences

Regular

• No changes between 4.4 and 4.8 ✅
• No changes between 4.8 and 4.10 ✅
• Changed between 4.10 and 4.13 ⚠️

  • Field added. struct (anon) module
• No changes between 4.13 and 4.15 ✅
• Changed between 4.15 and 4.18 ⚠️

  • Field type changed. struct timespec ctime ➡️ struct timespec64 ctime
• No changes between 4.18 and 5.0 ✅
• No changes between 5.0 and 5.3 ✅
• No changes between 5.3 and 5.4 ✅
• Changed between 5.4 and 5.8 ⚠️

  • Field added. struct lsmblob target_lsm
  • Field removed. u32 target_sid
• No changes between 5.8 and 5.11 ✅
• No changes between 5.11 and 5.13 ✅
• No changes between 5.13 and 5.15 ✅
• Changed between 5.15 and 5.19 ⚠️

  • Field added. enum (anon) context
  • Field added. struct audit_stamp stamp
  • Field added. int uring_op
  • Field added. struct open_how openat2
  • Field added. struct (anon) time
  • Field removed. int in_syscall
  • Field removed. unsigned int serial
  • Field removed. struct timespec64 ctime
• Changed between 5.19 and 6.2 ⚠️

  • Field removed. pid_t pid
• No changes between 6.2 and 6.5 ✅
• Changed between 6.5 and 6.8 ⚠️

  • Field added. struct lsmblob target_blob
  • Field removed. struct lsmblob target_lsm

Arch

• No changes between amd64 and arm64 ✅
• No changes between amd64 and armhf ✅
• No changes between amd64 and ppc64el ✅
• No changes between amd64 and riscv64 ✅

Flavor

• No changes between generic and aws ✅
• No changes between generic and azure ✅
• No changes between generic and gcp ✅
• No changes between generic and lowlatency ✅