AUDIT\_CAN\_CONTROL(3) Linux Audit API AUDIT\_CAN\_CONTROL(3)

# [NAME](#NAME)

audit\_can\_control, audit\_can\_write, audit\_can\_read - test audit related capabilities

# [SYNOPSIS](#SYNOPSIS)

**#include <libaudit.h>**

**int audit\_can\_control(void);**  
**int audit\_can\_write(void);**  
**int audit\_can\_read(void);**

# [DESCRIPTION](#DESCRIPTION)

**audit\_can\_control**() returns 1 if the calling process possesses the **CAP\_AUDIT\_CONTROL** capability, otherwise 0. **audit\_can\_write**() returns 1 if **CAP\_AUDIT\_WRITE** is available. **audit\_can\_read**() returns 1 if **CAP\_AUDIT\_READ** is present. When libcap-ng support is not available these functions return 1 only when the effective UID is 0.

# [RETURN VALUE](#RETURN_VALUE)

These functions return 1 when the capability is present and 0 otherwise.

# [SEE ALSO](#SEE_ALSO)

[**audit\_open**(3)](/man/os/audit/audit_open.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

July 2025 Red Hat

---

Document: audit_can_read(3) from audit 4.2.1-r3 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace