[PATCH] log more info for directory entry change events

When an audit event involves changes to a directory entry, include
a PATH record for the directory itself.  A few other notable changes:

    - fixed audit_inode_child() hooks in fsnotify_move()
    - removed unused flags arg from audit_inode()
    - added audit log routines for logging a portion of a string

Here's some sample output.

before patch:
type=SYSCALL msg=audit(1149821605.320:26): arch=40000003 syscall=39 success=yes exit=0 a0=bf8d3c7c a1=1ff a2=804e1b8 a3=bf8d3c7c items=1 ppid=739 pid=800 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149821605.320:26):  cwd="/root"
type=PATH msg=audit(1149821605.320:26): item=0 name="foo" parent=164068 inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

after patch:
type=SYSCALL msg=audit(1149822032.332:24): arch=40000003 syscall=39 success=yes exit=0 a0=bfdd9c7c a1=1ff a2=804e1b8 a3=bfdd9c7c items=2 ppid=714 pid=777 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 comm="mkdir" exe="/bin/mkdir" subj=root:system_r:unconfined_t:s0-s0:c0.c255
type=CWD msg=audit(1149822032.332:24):  cwd="/root"
type=PATH msg=audit(1149822032.332:24): item=0 name="/root" inode=164068 dev=03:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_dir_t:s0
type=PATH msg=audit(1149822032.332:24): item=1 name="foo" inode=164010 dev=03:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=root:object_r:user_home_t:s0

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

3 files changed, 5 insertions, 5 deletions

diff --git a/fs/namei.c b/fs/namei.c
index d6e2ee251736..184fe4acf824 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1127,7 +1127,7 @@ out:
         if (likely(retval == 0)) {
                 if (unlikely(current->audit_context && nd && nd->dentry &&
                                 nd->dentry->d_inode))
-                audit_inode(name, nd->dentry->d_inode, flags);
+                audit_inode(name, nd->dentry->d_inode);
         }
 out_fail:
         return retval;
diff --git a/fs/open.c b/fs/open.c
index 317b7c7f38a7..4f178acd4c09 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -633,7 +633,7 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
         dentry = file->f_dentry;
         inode = dentry->d_inode;
 
-        audit_inode(NULL, inode, 0);
+        audit_inode(NULL, inode);
 
         err = -EROFS;
         if (IS_RDONLY(inode))
@@ -786,7 +786,7 @@ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
         if (file) {
                 struct dentry * dentry;
                 dentry = file->f_dentry;
-                audit_inode(NULL, dentry->d_inode, 0);
+                audit_inode(NULL, dentry->d_inode);
                 error = chown_common(dentry, user, group);
                 fput(file);
         }
diff --git a/fs/xattr.c b/fs/xattr.c
index e416190f5e9c..c32f15b5f60f 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -242,7 +242,7 @@ sys_fsetxattr(int fd, char __user *name, void __user *value,
         if (!f)
                 return error;
         dentry = f->f_dentry;
-        audit_inode(NULL, dentry->d_inode, 0);
+        audit_inode(NULL, dentry->d_inode);
         error = setxattr(dentry, name, value, size, flags);
         fput(f);
         return error;
@@ -469,7 +469,7 @@ sys_fremovexattr(int fd, char __user *name)
         if (!f)
                 return error;
         dentry = f->f_dentry;
-        audit_inode(NULL, dentry->d_inode, 0);
+        audit_inode(NULL, dentry->d_inode);
         error = removexattr(dentry, name);
         fput(f);
         return error;