---
name: "__audit_inode_child"
section: "9"
platform: "linux"
package: "linux-manual-2.6.18"
version: "2.6.18.dfsg.1-26etch2"
release: "Debian 4.0 (Etch)"
platforms: ["linux"]
url: "https://new.carta.tech/__audit_inode_child"
---

# \_\_audit\_inode\_child(9)

collect inode info for created/removed objects

## NAME

\_\_audit\_inode\_child - collect inode info for created/removed objects

## SYNOPSIS

**void \_\_audit\_inode\_child(const char \*** *dname***, const struct inode \*** *inode***, const struct inode \*** *parent***);**

## ARGUMENTS

*dname*

inode's dentry name

*inode*

inode being audited

*parent*

inode of dentry parent

## DESCRIPTION

For syscalls that create or remove filesystem objects, audit\_inode can only collect information for the filesystem object's parent. This call updates the audit context with the child's information. Syscalls that create a new filesystem object must be hooked after the object is created. Syscalls that remove a filesystem object must be hooked prior, in order to capture the target inode during unsuccessful attempts.

## COPYRIGHT