AUDIT_CAN_CONTROL(3) Linux Audit API AUDIT_CAN_CONTROL(3)

audit_can_control, audit_can_write, audit_can_read - test audit related capabilities

#include <libaudit.h>

int audit_can_control(void);
int audit_can_write(void);
int audit_can_read(void);

audit_can_control() returns 1 if the calling process possesses the CAP_AUDIT_CONTROL capability, otherwise 0. audit_can_write() returns 1 if CAP_AUDIT_WRITE is available. audit_can_read() returns 1 if CAP_AUDIT_READ is present. When libcap-ng support is not available these functions return 1 only when the effective UID is 0.

These functions return 1 when the capability is present and 0 otherwise.

audit_open(3).

Steve Grubb

July 2025 Red Hat