Commit 220d14df authored by Eric Paris's avatar Eric Paris
Browse files

Audit: only set group mask when something is being watched

Currently the audit watch group always sets a mask equal to all events it
might care about.  We instead should only set the group mask if we are
actually watching inodes.  This should be a perf win when audit watches are
compiled in.
Signed-off-by: default avatarEric Paris <>
parent ffab8340
......@@ -167,6 +167,8 @@ static struct audit_parent *audit_init_parent(struct nameidata *ndp)
return ERR_PTR(ret);
return parent;
......@@ -353,6 +355,9 @@ static void audit_remove_parent_watches(struct audit_parent *parent)
/* Get path information necessary for adding watches. */
......@@ -503,6 +508,9 @@ void audit_remove_watch_rule(struct audit_krule *krule)
static bool audit_watch_should_send_event(struct fsnotify_group *group, struct inode *inode,
......@@ -577,8 +585,7 @@ static const struct fsnotify_ops audit_watch_fsnotify_ops = {
static int __init audit_watch_init(void)
audit_watch_group = fsnotify_alloc_group(AUDIT_FS_WATCH,
audit_watch_group = fsnotify_alloc_group(0, &audit_watch_fsnotify_ops);
if (IS_ERR(audit_watch_group)) {
audit_watch_group = NULL;
audit_panic("cannot create audit fsnotify group");
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment