From 310eb24881aead0a5df7e764a3763352d65ac070 Mon Sep 17 00:00:00 2001
From: Alexander Viro <aviro@redhat.com>
Date: Fri, 29 Sep 2006 00:08:50 -0400
Subject: [PATCH] --- yaml --- r: 38477 b: refs/heads/master c:
 419c58f11fb732cc8bd1335fa43e0decb34e0be3 h: refs/heads/master i:   38475:
 66371fc41e2bf8fffbf49586431cd521c588be67 v: v3

---
 [refs]                 | 2 +-
 trunk/kernel/auditsc.c | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index adee35defa71..75d1e9f62b0b 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4b8a311bb161a3bd2ab44311f42c526b6dc76270
+refs/heads/master: 419c58f11fb732cc8bd1335fa43e0decb34e0be3
diff --git a/trunk/kernel/auditsc.c b/trunk/kernel/auditsc.c
index 105147631753..b61c0191f3da 100644
--- a/trunk/kernel/auditsc.c
+++ b/trunk/kernel/auditsc.c
@@ -278,8 +278,11 @@ static int audit_filter_rules(struct task_struct *tsk,
 			result = audit_comparator(tsk->pid, f->op, f->val);
 			break;
 		case AUDIT_PPID:
-			if (ctx)
+			if (ctx) {
+				if (!ctx->ppid)
+					ctx->ppid = sys_getppid();
 				result = audit_comparator(ctx->ppid, f->op, f->val);
+			}
 			break;
 		case AUDIT_UID:
 			result = audit_comparator(tsk->uid, f->op, f->val);
@@ -795,7 +798,8 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
 
 	/* tsk == current */
 	context->pid = tsk->pid;
-	context->ppid = sys_getppid();	/* sic.  tsk == current in all cases */
+	if (!context->ppid)
+		context->ppid = sys_getppid();
 	context->uid = tsk->uid;
 	context->gid = tsk->gid;
 	context->euid = tsk->euid;
@@ -1137,6 +1141,7 @@ void audit_syscall_entry(int arch, int major,
 	context->ctime      = CURRENT_TIME;
 	context->in_syscall = 1;
 	context->auditable  = !!(state == AUDIT_RECORD_CONTEXT);
+	context->ppid       = 0;
 }
 
 /**