1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ANSI_X3.4-1968"><title>__audit_syscall_exit</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="The Linux Kernel API"><link rel="up" href="audit.html" title="Chapter&#160;12.&#160;Audit Interfaces"><link rel="prev" href="API---audit-syscall-entry.html" title="__audit_syscall_entry"><link rel="next" href="API---audit-reusename.html" title="__audit_reusename"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center"><span class="phrase">__audit_syscall_exit</span></th></tr><tr><td width="20%" align="left"><a accesskey="p" href="API---audit-syscall-entry.html">Prev</a>&#160;</td><th width="60%" align="center">Chapter&#160;12.&#160;Audit Interfaces</th><td width="20%" align="right">&#160;<a accesskey="n" href="API---audit-reusename.html">Next</a></td></tr></table><hr></div><div class="refentry"><a name="API---audit-syscall-exit"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>__audit_syscall_exit &#8212; 
2     deallocate audit context after a system call
3 </p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="funcsynopsis"><table border="0" class="funcprototype-table" summary="Function synopsis" style="cellspacing: 0; cellpadding: 0;"><tr><td><code class="funcdef">void <b class="fsfunc">__audit_syscall_exit </b>(</code></td><td>int <var class="pdparam">success</var>, </td></tr><tr><td>&#160;</td><td>long <var class="pdparam">return_code</var><code>)</code>;</td></tr></table><div class="funcprototype-spacer">&#160;</div></div></div><div class="refsect1"><a name="idp1127551452"></a><h2>Arguments</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term"><em class="parameter"><code>success</code></em></span></dt><dd><p>
4     success value of the syscall
5    </p></dd><dt><span class="term"><em class="parameter"><code>return_code</code></em></span></dt><dd><p>
6     return value of the syscall
7    </p></dd></dl></div></div><div class="refsect1"><a name="idp1127554108"></a><h2>Description</h2><p>
8   Tear down after system call.  If the audit context has been marked as
9   auditable (either because of the AUDIT_RECORD_CONTEXT state from
10   filtering, or because some other part of the kernel wrote an audit
11   message), then write out the syscall information.  In call cases,
12   free the names stored from <code class="function">getname</code>.
13</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="API---audit-syscall-entry.html">Prev</a>&#160;</td><td width="20%" align="center"><a accesskey="u" href="audit.html">Up</a></td><td width="40%" align="right">&#160;<a accesskey="n" href="API---audit-reusename.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"><span class="phrase">__audit_syscall_entry</span>&#160;</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">&#160;<span class="phrase">__audit_reusename</span></td></tr></table></div></body></html>
14