While reworking lookup_open() to implement O_CREAT|O_DIRECTORY I came across inconsistency in how audit_inode_child() is called in various file create paths.
audit_inode_child() is called in may_create_dentry() so that failed filesystem operations still register an audit entry. On success, the entry is overwritten when, for instance, fsnotify_create() is called. This is the calling convention in vfs_create() and vfs_mkdir(). In lookup_open(), however, when atomic_open() should have created a file but didn't, no call to audit_inode_child() is made. The same is true for the regular ->create() path. On the suggestion of Brauner, I am splitting this series from the O_CREAT|O_DIRECTORY work, so that this can be discussed with the audit people without delaying that work. Jori Koolstra (3): vfs: move create error && negative dentry case in lookup_open() up vfs: call audit_inode_child() in lookup_open() on failure fs/namei.c: update kerneldoc of atomic_open() fs/namei.c | 128 ++++++++++++++++++++++++++++++++--------------------- 1 file changed, 78 insertions(+), 50 deletions(-) -- 2.55.0
