__audit_inode_child(9)
NAME
- __audit_inode_child - collect inode info for created/re
- moved objects
SYNOPSIS
void __audit_inode_child(const char * dname, const struct
inode * inode, const struct inode * parent);
ARGUMENTS
- dname
- inode's dentry name
- inode
- inode being audited
- parent
- inode of dentry parent
DESCRIPTION
- For syscalls that create or remove filesystem objects, au
- dit_inode can only collect information for the filesystem ob
- ject's parent. This call updates the audit context with the
- child's information. Syscalls that create a new filesystem object
- must be hooked after the object is created. Syscalls that remove
- a filesystem object must be hooked prior, in order to capture the
- target inode during unsuccessful attempts.
COPYRIGHT