Re: [PATCH 0/3] vfs: call audit_inode_child() in lookup_open() on failure

> While reworking lookup_open() to implement O_CREAT|O_DIRECTORY I came
> across inconsistency in how audit_inode_child() is called in various
> file create paths.
> 
> audit_inode_child() is called in may_create_dentry() so that failed
> filesystem operations still register an audit entry. On success, the
> entry is overwritten when, for instance, fsnotify_create() is called.
> This is the calling convention in vfs_create() and vfs_mkdir().
> In lookup_open(), however, when atomic_open() should have created a
> file but didn't, no call to audit_inode_child() is made. The same is
> true for the regular ->create() path.
> 
> On the suggestion of Brauner, I am splitting this series from the
> O_CREAT|O_DIRECTORY work, so that this can be discussed with the audit
> people without delaying that work.

Looks good to me. I'll wait for the audit people to look at it too.

--