[PATCH] fix missed create event for directory audit

When an object is created via a symlink into an audited directory, audit misses
the event due to not having collected the inode data for the directory.  Modify
__audit_inode_child() to copy the parent inode data if a parent wasn't found in
audit_names[].

Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

2 files changed, 7 insertions, 7 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index e7e5e5348987..bf196c05826c 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -327,7 +327,7 @@ extern void __audit_getname(const char *name);
 extern void audit_putname(const char *name);
 extern void __audit_inode(const char *name, const struct inode *inode);
 extern void __audit_inode_child(const char *dname, const struct inode *inode,
-                                unsigned long pino);
+                                const struct inode *parent);
 extern void __audit_inode_update(const struct inode *inode);
 static inline void audit_getname(const char *name)
 {
@@ -339,10 +339,10 @@ static inline void audit_inode(const char *name, const struct inode *inode) {
                 __audit_inode(name, inode);
 }
 static inline void audit_inode_child(const char *dname, 
-                                     const struct inode *inode, 
-                                     unsigned long pino) {
+                                     const struct inode *inode,
+                                     const struct inode *parent) {
         if (unlikely(current->audit_context))
-                __audit_inode_child(dname, inode, pino);
+                __audit_inode_child(dname, inode, parent);
 }
 static inline void audit_inode_update(const struct inode *inode) {
         if (unlikely(current->audit_context))
diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
index cc5dec70c32c..d4f219ffaa5d 100644
--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -67,7 +67,7 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
         if (source) {
                 inotify_inode_queue_event(source, IN_MOVE_SELF, 0, NULL, NULL);
         }
-        audit_inode_child(new_name, source, new_dir->i_ino);
+        audit_inode_child(new_name, source, new_dir);
 }
 
 /*
@@ -98,7 +98,7 @@ static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)
         inode_dir_notify(inode, DN_CREATE);
         inotify_inode_queue_event(inode, IN_CREATE, 0, dentry->d_name.name,
                                   dentry->d_inode);
-        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode->i_ino);
+        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode);
 }
 
 /*
@@ -109,7 +109,7 @@ static inline void fsnotify_mkdir(struct inode *inode, struct dentry *dentry)
         inode_dir_notify(inode, DN_CREATE);
         inotify_inode_queue_event(inode, IN_CREATE | IN_ISDIR, 0, 
                                   dentry->d_name.name, dentry->d_inode);
-        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode->i_ino);
+        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode);
 }
 
 /*