[PATCH ALT3] audit: hide PATH records of anonymous parents and their children

[Richard Guy Briggs]

Tracefs or debugfs were causing hundreds to thousands of null PATH records to
be associated with the init_module and finit_module SYSCALL records on a few
modules when the following rule was in place for startup:
        -a always,exit -F arch=x86_64 -S init_module -F key=mod-load

This patch hides those records, but the SYSCALL record "items=" count will
still reflect the number of hidden items.  (This will fail the test below.)

See https://github.com/linux-audit/audit-kernel/issues/8
Test case: https://github.com/linux-audit/audit-testsuite/issues/42

Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
---
 kernel/auditsc.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4db32e8..58ea64e 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1914,6 +1914,7 @@ void __audit_inode_child(struct inode *parent,
 		if (!n)
 			return;
 		audit_copy_inode(n, NULL, parent);
+		n->hidden = true;
 	}
 
 	if (!found_child) {
@@ -1928,6 +1929,8 @@ void __audit_inode_child(struct inode *parent,
 			found_child->name = found_parent->name;
 			found_child->name_len = AUDIT_NAME_FULL;
 			found_child->name->refcnt++;
+		} else {
+			found_child->hidden = true;
 		}
 	}
 
-- 
1.7.1