Allocate an audit context block for a task
int audit_alloc(struct task_struct * tsk);
tsk
task
Filter on the task information and allocate a per-task audit context if necessary. Doing so turns on system call auditing for the specified task. This is called from copy_process, so no lock is needed.