svc · unix #350
audit
Submits a pre-formatted BSM audit record to the kernel audit queue.
Prototype
int audit(void *record, int length);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| record | void | - | |
| length | int | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 350 |
| xnu-1699.24.8 | macOS 10.7 Lion | 350 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 350 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 350 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 350 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 350 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 350 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 350 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 350 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 350 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 350 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 350 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 350 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 350 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 350 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 350 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 350 |
| xnu-10002.41.9 | — | 350 |
| xnu-10002.61.3 | — | 350 |
| xnu-10002.81.5 | — | 350 |
| xnu-10063.101.15 | — | 350 |
| xnu-10063.121.3 | — | 350 |
| xnu-10063.141.1 | — | 350 |
| xnu-11215.41.3 | — | 350 |
| xnu-11215.61.5 | — | 350 |
| xnu-11215.81.4 | — | 350 |
| xnu-11417.121.6 | — | 350 |
| xnu-11417.140.69 | — | 350 |
| xnu-12377.101.15 | — | 350 |
| xnu-12377.41.6 | — | 350 |
| xnu-12377.61.12 | — | 350 |
| xnu-12377.81.4 | — | 350 |
| xnu-1486.2.11 | — | 350 |
| xnu-1504.15.3 | — | 350 |
| xnu-1504.3.12 | — | 350 |
| xnu-1504.7.4 | — | 350 |
| xnu-1504.9.17 | — | 350 |
| xnu-1504.9.26 | — | 350 |
| xnu-1504.9.37 | — | 350 |
| xnu-1699.22.73 | — | 350 |
| xnu-1699.22.81 | — | 350 |
| xnu-1699.24.23 | — | 350 |
| xnu-1699.26.8 | — | 350 |
| xnu-1699.32.7 | — | 350 |
| xnu-2050.22.13 | — | 350 |
| xnu-2050.24.15 | — | 350 |
| xnu-2050.48.11 | — | 350 |
| xnu-2050.7.9 | — | 350 |
| xnu-2050.9.2 | — | 350 |
| xnu-2422.1.72 | — | 350 |
| xnu-2422.100.13 | — | 350 |
| xnu-2422.110.17 | — | 350 |
| xnu-2422.90.20 | — | 350 |
| xnu-2782.1.97 | — | 350 |
| xnu-2782.10.72 | — | 350 |
| xnu-2782.20.48 | — | 350 |
| xnu-2782.30.5 | — | 350 |
| xnu-3247.10.11 | — | 350 |
| xnu-3248.20.55 | — | 350 |
| xnu-3248.30.4 | — | 350 |
| xnu-3248.40.184 | — | 350 |
| xnu-3248.50.21 | — | 350 |
| xnu-3248.60.10 | — | 350 |
| xnu-3789.21.4 | — | 350 |
| xnu-3789.31.2 | — | 350 |
| xnu-3789.41.3 | — | 350 |
| xnu-3789.51.2 | — | 350 |
| xnu-3789.60.24 | — | 350 |
| xnu-3789.70.16 | — | 350 |
| xnu-4570.20.62 | — | 350 |
| xnu-4570.31.3 | — | 350 |
| xnu-4570.41.2 | — | 350 |
| xnu-4570.51.1 | — | 350 |
| xnu-4570.61.1 | — | 350 |
| xnu-4570.71.2 | — | 350 |
| xnu-4903.231.4 | — | 350 |
| xnu-4903.241.1 | — | 350 |
| xnu-4903.270.47 | — | 350 |
| xnu-6153.101.6 | — | 350 |
| xnu-6153.121.1 | — | 350 |
| xnu-6153.141.1 | — | 350 |
| xnu-6153.41.3 | — | 350 |
| xnu-6153.61.1 | — | 350 |
| xnu-6153.81.5 | — | 350 |
| xnu-7195.101.1 | — | 350 |
| xnu-7195.121.3 | — | 350 |
| xnu-7195.141.2 | — | 350 |
| xnu-7195.60.75 | — | 350 |
| xnu-7195.81.3 | — | 350 |
| xnu-8019.61.5 | — | 350 |
| xnu-8019.80.24 | — | 350 |
| xnu-8020.101.4 | — | 350 |
| xnu-8020.121.3 | — | 350 |
| xnu-8020.140.41 | — | 350 |
| xnu-8792.61.2 | — | 350 |
| xnu-8792.81.2 | — | 350 |
| xnu-8796.101.5 | — | 350 |
| xnu-8796.121.2 | — | 350 |
| xnu-8796.141.3 | — | 350 |
Notes
audit(2) is the userspace entry point for trusted processes (auditd, login, sshd) to inject their own BSM tokens into the kernel's audit trail. It is restricted to processes with the audit_control privilege and is largely vestigial on modern macOS since auditd was deprecated in macOS 11 in favor of Endpoint Security. The record buffer must already be a valid sequence of BSM tokens — the kernel only validates the header and length.
Detection
Observable via the AUE_AUDIT audit event itself and via Endpoint Security's ES_EVENT_TYPE_AUTH_GET_TASK family is unrelated; for audit pipeline tampering, watch for non-auditd PIDs calling audit() or for sudden gaps in /var/audit/. DTrace probe audit:::commit catches every submitted record.