Reference

__audit_inode_update(9)

update inode info for last collected name

NAME

__audit_inode_update - update inode info for last collected name

SYNOPSIS

void __audit_inode_update(const struct inode * inode);

ARGUMENTS

inode

inode being audited

DESCRIPTION

When open is called on an existing object with the O_CREAT flag, the inode data audit initially collects is incorrect. This additional hook ensures audit has the inode data for the actual object to be opened.

COPYRIGHT