4 files changed, 34 insertions, 7 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index b20b03852f21..729a4d165bcc 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -103,8 +103,11 @@ extern void __audit_syscall_exit(int ret_success, long ret_value);
 extern struct filename *__audit_reusename(const __user char *uptr);
 extern void __audit_getname(struct filename *name);
 extern void audit_putname(struct filename *name);
+
+#define AUDIT_INODE_PARENT      1       /* dentry represents the parent */
+#define AUDIT_INODE_HIDDEN      2       /* audit record should be hidden */
 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
-                                unsigned int parent);
+                                unsigned int flags);
 extern void __audit_inode_child(const struct inode *parent,
                                 const struct dentry *dentry,
                                 const unsigned char type);
@@ -148,10 +151,22 @@ static inline void audit_getname(struct filename *name)
         if (unlikely(!audit_dummy_context()))
                 __audit_getname(name);
 }
-static inline void audit_inode(struct filename *name, const struct dentry *dentry,
+static inline void audit_inode(struct filename *name,
+                                const struct dentry *dentry,
                                 unsigned int parent) {
+        if (unlikely(!audit_dummy_context())) {
+                unsigned int flags = 0;
+                if (parent)
+                        flags |= AUDIT_INODE_PARENT;
+                __audit_inode(name, dentry, flags);
+        }
+}
+static inline void audit_inode_parent_hidden(struct filename *name,
+                                                const struct dentry *dentry)
+{
         if (unlikely(!audit_dummy_context()))
-                __audit_inode(name, dentry, parent);
+                __audit_inode(name, dentry,
+                                AUDIT_INODE_PARENT | AUDIT_INODE_HIDDEN);
 }
 static inline void audit_inode_child(const struct inode *parent,
                                      const struct dentry *dentry,
@@ -311,7 +326,7 @@ static inline void audit_putname(struct filename *name)
 { }
 static inline void __audit_inode(struct filename *name,
                                         const struct dentry *dentry,
-                                        unsigned int parent)
+                                        unsigned int flags)
 { }
 static inline void __audit_inode_child(const struct inode *parent,
                                         const struct dentry *dentry,
@@ -321,6 +336,9 @@ static inline void audit_inode(struct filename *name,
                                 const struct dentry *dentry,
                                 unsigned int parent)
 { }
+static inline void audit_inode_parent_hidden(struct filename *name,
+                                const struct dentry *dentry)
+{ }
 static inline void audit_inode_child(const struct inode *parent,
                                      const struct dentry *dentry,
                                      const unsigned char type)
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index e4e47f647446..ae1996d3c539 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -823,6 +823,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, umode_t, mode,
                                 error = ro;
                                 goto out;
                         }
+                        audit_inode_parent_hidden(name, root);
                         filp = do_create(ipc_ns, root->d_inode,
                                                 &path, oflag, mode,
                                                 u_attr ? &attr : NULL);
@@ -868,6 +869,7 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
         if (IS_ERR(name))
                 return PTR_ERR(name);
 
+        audit_inode_parent_hidden(name, mnt->mnt_root);
         err = mnt_want_write(mnt);
         if (err)
                 goto out_name;
diff --git a/kernel/audit.h b/kernel/audit.h
index 1c95131ef760..123c9b7c3979 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -85,6 +85,7 @@ struct audit_names {
 
         struct filename         *name;
         int                     name_len;       /* number of chars to log */
+        bool                    hidden;         /* don't log this record */
         bool                    name_put;       /* call __putname()? */
 
         unsigned long           ino;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3c8a601324a2..9845cb32b60a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1399,8 +1399,11 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
         }
 
         i = 0;
-        list_for_each_entry(n, &context->names_list, list)
+        list_for_each_entry(n, &context->names_list, list) {
+                if (n->hidden)
+                        continue;
                 audit_log_name(context, n, NULL, i++, &call_panic);
+        }
 
         /* Send end of event record to help user space know we are finished */
         ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
@@ -1769,14 +1772,15 @@ void audit_putname(struct filename *name)
  * __audit_inode - store the inode and device from a lookup
  * @name: name being audited
  * @dentry: dentry being audited
- * @parent: does this dentry represent the parent?
+ * @flags: attributes for this particular entry
  */
 void __audit_inode(struct filename *name, const struct dentry *dentry,
-                   unsigned int parent)
+                   unsigned int flags)
 {
         struct audit_context *context = current->audit_context;
         const struct inode *inode = dentry->d_inode;
         struct audit_names *n;
+        bool parent = flags & AUDIT_INODE_PARENT;
 
         if (!context->in_syscall)
                 return;
@@ -1831,6 +1835,8 @@ out:
         if (parent) {
                 n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
                 n->type = AUDIT_TYPE_PARENT;
+                if (flags & AUDIT_INODE_HIDDEN)
+                        n->hidden = true;
         } else {
                 n->name_len = AUDIT_NAME_FULL;
                 n->type = AUDIT_TYPE_NORMAL;