From fddc39adeea7663e7290f042eaf83fcc2fcf92bd Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 6 May 2006 08:26:27 -0400
Subject: [PATCH] --- yaml --- r: 28025 b: refs/heads/master c:
 3c66251e573219a0532a5a07381b2f60a412d9eb h: refs/heads/master i:   28023:
 f147f7ba876fbaf300d312439c8cae0d6f44f1e8 v: v3

---
 [refs]                      | 2 +-
 trunk/include/linux/audit.h | 1 +
 trunk/kernel/auditsc.c      | 4 ++++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 527dcca1a405..b2e2dd297de3 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: f46038ff7d23ae092d61b366332c05aab8227b48
+refs/heads/master: 3c66251e573219a0532a5a07381b2f60a412d9eb
diff --git a/trunk/include/linux/audit.h b/trunk/include/linux/audit.h
index 1057e90bd3e3..8f6424f2b604 100644
--- a/trunk/include/linux/audit.h
+++ b/trunk/include/linux/audit.h
@@ -152,6 +152,7 @@
 #define AUDIT_SE_TYPE	15	/* security label type */
 #define AUDIT_SE_SEN	16	/* security label sensitivity label */
 #define AUDIT_SE_CLR	17	/* security label clearance label */
+#define AUDIT_PPID	18
 
 				/* These are ONLY useful when checking
 				 * at syscall exit time (AUDIT_AT_EXIT). */
diff --git a/trunk/kernel/auditsc.c b/trunk/kernel/auditsc.c
index 4fc3867fa25a..e4551659ad79 100644
--- a/trunk/kernel/auditsc.c
+++ b/trunk/kernel/auditsc.c
@@ -188,6 +188,10 @@ static int audit_filter_rules(struct task_struct *tsk,
 		case AUDIT_PID:
 			result = audit_comparator(tsk->pid, f->op, f->val);
 			break;
+		case AUDIT_PPID:
+			if (ctx)
+				result = audit_comparator(ctx->ppid, f->op, f->val);
+			break;
 		case AUDIT_UID:
 			result = audit_comparator(tsk->uid, f->op, f->val);
 			break;