[PATCH ALT3] audit: hide PATH records of anonymous parents and their children

Tracefs or debugfs were causing hundreds to thousands of null PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load This patch hides those records, but the SYSCALL record "items=" count will still reflect the number of hidden items. (This will fail the test below.) See https://github.com/linux-audit/audit-kernel/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- kernel/auditsc.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4db32e8..58ea64e 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1914,6 +1914,7 @@ void __audit_inode_child(struct inode *parent, if (!n) return; audit_copy_inode(n, NULL, parent); + n->hidden = true; } if (!found_child) { @@ -1928,6 +1929,8 @@ void __audit_inode_child(struct inode *parent, found_child->name = found_parent->name; found_child->name_len = AUDIT_NAME_FULL; found_child->name->refcnt++; + } else { + found_child->hidden = true; } } -- 1.7.1