> Op 24-07-2026 23:10 CEST schreef Paul Moore <[email protected]>: > > > On Jul 10, 2026 Jori Koolstra <[email protected]> wrote: > > > > audit_inode_child() is called in may_create_dentry() so that failed > > filesystem operations still register an audit entry. On success, the > > entry is overwritten when, for instance, fsnotify_create() is called. > > This is the calling convention in vfs_create() and vfs_mkdir(). > > In lookup_open(), however, when atomic_open() should have created a > > file but didn't, no call to audit_inode_child() is made. The same is > > true for the regular ->create() path. > > > > Fix the calling of audit_inode_child() in lookup_open() to match the > > vfs_create() path. For the ->atomic_open() filesystems this logic has > > been pushed into atomic_open(). This function is also reordered a bit > > to make the case distinction of the possible returns from > > ->atomic_open() more explicit (i.e. finish_open() or finish_no_open()). > > > > When retrying delegation breaking, audit_inode_child() could be called > > more than once, but this is OK because those entries are reused. > > > > Signed-off-by: Jori Koolstra <[email protected]> > > --- > > fs/namei.c | 92 ++++++++++++++++++++++++++++++++---------------------- > > 1 file changed, 55 insertions(+), 37 deletions(-) > > I didn't dig into the directory lease/delegation changes because there > are better people on the To/CC line to comment on that, but the audit > changes look good to me. Thanks for working on this, help is always > appreciated :) > > Acked-by: Paul Moore (audit) <[email protected]> >
Thanks for the review, Paul. @Christian, will you take this up into the vfs tree or does this go through audit?
