[PATCH] add filtering by ppid

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 4 insertions, 0 deletions

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4fc3867fa25a..e4551659ad79 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -188,6 +188,10 @@ static int audit_filter_rules(struct task_struct *tsk,
                 case AUDIT_PID:
                         result = audit_comparator(tsk->pid, f->op, f->val);
                         break;
+                case AUDIT_PPID:
+                        if (ctx)
+                                result = audit_comparator(ctx->ppid, f->op, f->val);
+                        break;
                 case AUDIT_UID:
                         result = audit_comparator(tsk->uid, f->op, f->val);
                         break;