1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ANSI_X3.4-1968"><title>__audit_syscall_entry</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="The Linux Kernel API"><link rel="up" href="audit.html" title="Chapter&#160;12.&#160;Audit Interfaces"><link rel="prev" href="API---audit-free.html" title="__audit_free"><link rel="next" href="API---audit-syscall-exit.html" title="__audit_syscall_exit"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center"><span class="phrase">__audit_syscall_entry</span></th></tr><tr><td width="20%" align="left"><a accesskey="p" href="API---audit-free.html">Prev</a>&#160;</td><th width="60%" align="center">Chapter&#160;12.&#160;Audit Interfaces</th><td width="20%" align="right">&#160;<a accesskey="n" href="API---audit-syscall-exit.html">Next</a></td></tr></table><hr></div><div class="refentry"><a name="API---audit-syscall-entry"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>__audit_syscall_entry &#8212; 
2     fill in an audit record at syscall entry
3 </p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="funcsynopsis"><table border="0" class="funcprototype-table" summary="Function synopsis" style="cellspacing: 0; cellpadding: 0;"><tr><td><code class="funcdef">void <b class="fsfunc">__audit_syscall_entry </b>(</code></td><td>int <var class="pdparam">major</var>, </td></tr><tr><td>&#160;</td><td>unsigned long <var class="pdparam">a1</var>, </td></tr><tr><td>&#160;</td><td>unsigned long <var class="pdparam">a2</var>, </td></tr><tr><td>&#160;</td><td>unsigned long <var class="pdparam">a3</var>, </td></tr><tr><td>&#160;</td><td>unsigned long <var class="pdparam">a4</var><code>)</code>;</td></tr></table><div class="funcprototype-spacer">&#160;</div></div></div><div class="refsect1"><a name="idp1127539484"></a><h2>Arguments</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term"><em class="parameter"><code>major</code></em></span></dt><dd><p>
4     major syscall type (function)
5    </p></dd><dt><span class="term"><em class="parameter"><code>a1</code></em></span></dt><dd><p>
6     additional syscall register 1
7    </p></dd><dt><span class="term"><em class="parameter"><code>a2</code></em></span></dt><dd><p>
8     additional syscall register 2
9    </p></dd><dt><span class="term"><em class="parameter"><code>a3</code></em></span></dt><dd><p>
10     additional syscall register 3
11    </p></dd><dt><span class="term"><em class="parameter"><code>a4</code></em></span></dt><dd><p>
12     additional syscall register 4
13    </p></dd></dl></div></div><div class="refsect1"><a name="idp1127545172"></a><h2>Description</h2><p>
14   Fill in audit context at syscall entry.  This only happens if the
15   audit context was created when the task was created and the state or
16   filters demand the audit context be built.  If the state from the
17   per-task filter or from the per-syscall filter is AUDIT_RECORD_CONTEXT,
18   then the record will be written at syscall exit time (otherwise, it
19   will only be written if another part of the kernel requests that it
20   be written).
21</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="API---audit-free.html">Prev</a>&#160;</td><td width="20%" align="center"><a accesskey="u" href="audit.html">Up</a></td><td width="40%" align="right">&#160;<a accesskey="n" href="API---audit-syscall-exit.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"><span class="phrase">__audit_free</span>&#160;</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">&#160;<span class="phrase">__audit_syscall_exit</span></td></tr></table></div></body></html>
22