Re: [PATCH RFC 3/4] audit: return the collected inode entry from a private helper

[Paul Moore <paul@paul-moore.com>]

On Sep 17, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> Keep the __audit_inode() interface and collection behavior unchanged.
> Return the selected entry, or NULL when collection is skipped or fails,
> so audit_file() can attach descriptor-specific information reliably.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  kernel/auditsc.c | 28 ++++++++++++++++++++++------
>  1 file changed, 22 insertions(+), 6 deletions(-)
> 
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 464736499c83..b14765cdd56f 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2237,13 +2237,16 @@ static void audit_copy_inode(struct audit_names *name,
>  }
>  
>  /**
> - * __audit_inode - store the inode and device from a lookup
> + * audit_inode_entry - store the inode and device from a lookup
>   * @name: name being audited
>   * @dentry: dentry being audited
>   * @flags: attributes for this particular entry
> + *
> + * Return: the collected entry, or NULL if collection was skipped or failed.
>   */
> -void __audit_inode(struct filename *name, const struct dentry *dentry,
> -		   unsigned int flags)
> +static struct audit_names *audit_inode_entry(struct filename *name,
> +					     const struct dentry *dentry,
> +					     unsigned int flags)
>  {
>  	struct audit_context *context = audit_context();
>  	struct inode *inode = d_backing_inode(dentry);
> @@ -2254,7 +2257,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
>  	int i;
>  
>  	if (context->context == AUDIT_CTX_UNUSED)
> -		return;
> +		return NULL;
>  
>  	rcu_read_lock();
>  	list_for_each_entry_rcu(e, list, list) {
> @@ -2266,7 +2269,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
>  						f->op, f->val)
>  			    && e->rule.action == AUDIT_NEVER) {
>  				rcu_read_unlock();
> -				return;
> +				return NULL;
>  			}
>  		}
>  	}
> @@ -2320,7 +2323,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
>  	/* unable to find an entry with both a matching name and type */
>  	n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
>  	if (!n)
> -		return;
> +		return NULL;
>  	if (name) {
>  		n->name = name;
>  		name->refcnt++;
> @@ -2338,6 +2341,19 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
>  	}
>  	handle_path(dentry);
>  	audit_copy_inode(n, dentry, inode, flags & AUDIT_INODE_NOEVAL);
> +	return n;
> +}

Why can't we simply make __audit_inode() return an audit_names pointer?

There are only a small number of callers and they look like they could
happily ignore the return value.  You would probably need a forward
declaration of audit_names in include/linux/audit.h, but we have a number
of those at the top of the file already, one more isn't going to hurt.

> +/**
> + * __audit_inode - store the inode and device from a lookup
> + * @name: name being audited
> + * @dentry: dentry being audited
> + * @flags: attributes for this particular entry
> + */
> +void __audit_inode(struct filename *name, const struct dentry *dentry,
> +		   unsigned int flags)
> +{
> +	audit_inode_entry(name, dentry, flags);
>  }
>  
>  void __audit_file(const struct file *file)
> -- 
> 2.55.0

--
paul-moore.com