[PATCH] audit: dynamically allocate audit_names when not enough spaceis in the names...

[PATCH] audit: dynamically allocate audit_names when not enough spaceis in the names array

Some system calls, such as loading a module, can cause filesystem activity
such as creating lots of new files in /sys or debugfs. Audit can only capture
20 inodes in a single syscall since it stores them in a fixed length array.
This patch shrinks the fixed length array to 5 names (the number used by a
rename operation) and then allocates names dynamically as they are needed
after 5. It should shut up the complaints we sometimes see about
'name_count maxed, losing inode data" such as that seen in Red Hat bugzilla
445757.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Maxim Uvarov <maxim.uvarov@oracle.com>