<?xml version="1.0" encoding="ANSI_X3.4-1968" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ANSI_X3.4-1968" /><title>audit_syscall_entry</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /><link rel="home" href="index.html" title="The Linux Kernel API" /><link rel="up" href="ch12.html" title="Chapter 12. Audit Interfaces" /><link rel="prev" href="re468.html" title="audit_free" /><link rel="next" href="re470.html" title="audit_syscall_exit" /></head><body><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center"><span>audit_syscall_entry</span></th></tr><tr><td width="20%" align="left"><a accesskey="p" href="re468.html">Prev</a> </td><th width="60%" align="center">Chapter 12. Audit Interfaces</th><td width="20%" align="right"> <a accesskey="n" href="re470.html">Next</a></td></tr></table><hr /></div><div class="refentry" title="audit_syscall_entry"><a id="API-audit-syscall-entry"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>audit_syscall_entry —
fill in an audit record at syscall entry
</p></div><div class="refsynopsisdiv" title="Synopsis"><h2>Synopsis</h2><div class="funcsynopsis"><table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" class="funcprototype-table"><tr><td><code class="funcdef">void <b class="fsfunc">audit_syscall_entry </b>(</code></td><td>int <var class="pdparam">arch</var>, </td></tr><tr><td> </td><td>int <var class="pdparam">major</var>, </td></tr><tr><td> </td><td>unsigned long <var class="pdparam">a1</var>, </td></tr><tr><td> </td><td>unsigned long <var class="pdparam">a2</var>, </td></tr><tr><td> </td><td>unsigned long <var class="pdparam">a3</var>, </td></tr><tr><td> </td><td>unsigned long <var class="pdparam">a4</var><code>)</code>;</td></tr></table><div class="funcprototype-spacer"> </div></div></div><div class="refsect1" title="Arguments"><a id="id2690421"></a><h2>Arguments</h2><div class="variablelist"><dl><dt><span class="term"><em class="parameter"><code>arch</code></em></span></dt><dd><p>
architecture type
</p></dd><dt><span class="term"><em class="parameter"><code>major</code></em></span></dt><dd><p>
major syscall type (function)
</p></dd><dt><span class="term"><em class="parameter"><code>a1</code></em></span></dt><dd><p>
additional syscall register 1
</p></dd><dt><span class="term"><em class="parameter"><code>a2</code></em></span></dt><dd><p>
additional syscall register 2
</p></dd><dt><span class="term"><em class="parameter"><code>a3</code></em></span></dt><dd><p>
additional syscall register 3
</p></dd><dt><span class="term"><em class="parameter"><code>a4</code></em></span></dt><dd><p>
additional syscall register 4
</p></dd></dl></div></div><div class="refsect1" title="Description"><a id="id2690533"></a><h2>Description</h2><p>
Fill in audit context at syscall entry. This only happens if the
audit context was created when the task was created and the state or
filters demand the audit context be built. If the state from the
per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
then the record will be written at syscall exit time (otherwise, it
will only be written if another part of the kernel requests that it
be written).
</p></div></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="re468.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ch12.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="re470.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"><span>audit_free</span> </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> <span>audit_syscall_exit</span></td></tr></table></div></body></html>
