__audit_inode_child(9)

📦 version 7.3.1, in nixpkgs unstable

✨ __audit_inode_child — Kernel API Manual ✨

okay so bestie, you're about to meet the little audit helper that handles the children of filesystem objects 💅 like, the parent gets all the attention normally, but this one is for the created/removed objects themselves. main character energy fr fr 🎀

🌸 NAME 🌸

__audit_inode_child — collect inode info for created/removed objects 👑

🦋 SYNOPSIS 🦋

void __audit_inode_child (struct inode *parent , const struct dentry *dentry , const unsigned char type );

💖 ARGUMENTS 💖

  • parent — the inode of the dentry's parent 🌈 like, the parent's inode, got it
  • dentry — the dentry being audited 🎀 the actual thing we're looking at
  • type — an AUDIT_TYPE_* value that we're looking for ✨

🔥 DESCRIPTION 🔥

For syscalls that create or remove filesystem objects, audit_inode can only collect info for the filesystem object's parent — lowkey sad, I know 😭 This call right here updates the audit context with the child's information, so the child gets its moment too 💅✨

Syscalls that create a new filesystem object must be hooked after the object is created 🫶 periodt, no cap.

Syscalls that remove a filesystem object must be hooked prior — like, before — so that the target inode can be captured during unsuccessful attempts 👀💀 yes bestie, even the failed attempts matter, don't skip that part.

🧚 SEE ALSO 🧚

Kernel file ./kernel/auditsc.c and literally the whole friend group:

💜 ngl bestie, this is a kernel-internal audit thing — if you're reading this page, you're already deep in the ./kernel directory, so slay, you're exactly where you need to be 🫶

and that's the whole vibe check 🌈 this page lives in ./kernel, dated October 2026, and it's called __audit_inode_child(9) — iconic, no notes 💅✨🎀

📦 where this page comes from