2 files changed, 10 insertions, 3 deletions

diff --git a/kernel/audit.h b/kernel/audit.h
index 1c95131ef760..123c9b7c3979 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -85,6 +85,7 @@ struct audit_names {
 
         struct filename         *name;
         int                     name_len;       /* number of chars to log */
+        bool                    hidden;         /* don't log this record */
         bool                    name_put;       /* call __putname()? */
 
         unsigned long           ino;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3c8a601324a2..9845cb32b60a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1399,8 +1399,11 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
         }
 
         i = 0;
-        list_for_each_entry(n, &context->names_list, list)
+        list_for_each_entry(n, &context->names_list, list) {
+                if (n->hidden)
+                        continue;
                 audit_log_name(context, n, NULL, i++, &call_panic);
+        }
 
         /* Send end of event record to help user space know we are finished */
         ab = audit_log_start(context, GFP_KERNEL, AUDIT_EOE);
@@ -1769,14 +1772,15 @@ void audit_putname(struct filename *name)
  * __audit_inode - store the inode and device from a lookup
  * @name: name being audited
  * @dentry: dentry being audited
- * @parent: does this dentry represent the parent?
+ * @flags: attributes for this particular entry
  */
 void __audit_inode(struct filename *name, const struct dentry *dentry,
-                   unsigned int parent)
+                   unsigned int flags)
 {
         struct audit_context *context = current->audit_context;
         const struct inode *inode = dentry->d_inode;
         struct audit_names *n;
+        bool parent = flags & AUDIT_INODE_PARENT;
 
         if (!context->in_syscall)
                 return;
@@ -1831,6 +1835,8 @@ out:
         if (parent) {
                 n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
                 n->type = AUDIT_TYPE_PARENT;
+                if (flags & AUDIT_INODE_HIDDEN)
+                        n->hidden = true;
         } else {
                 n->name_len = AUDIT_NAME_FULL;
                 n->type = AUDIT_TYPE_NORMAL;