Bug 1296661

Summary:	RFE: audit of *at syscalls
Product:	[Fedora] Fedora	Reporter:	Steve Grubb <sgrubb>
Component:	kernel	Assignee:	Paul Moore <pmoore>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda, mchehab, rbriggs, sgrubb
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-01-12 16:57:30 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Steve Grubb 2016-01-07 19:08:44 UTC

Description of problem:
For the *at syscalls, can we get the path from the FD being passed as an argument to be able to reconstruct what is being accessed? (Readlink in /proc/<pid>/fds/# shows the path, why can't this go into the record? We may need a new auxiliary record type since this is neither the cwd or path.

This would be a big help since openat is used a lot.

Comment 1 Steve Grubb 2016-01-12 13:54:55 UTC

Seems to be a duplicate...closing.

Comment 2 Paul Moore 2016-01-12 14:12:56 UTC

Then please mark this BZ as a duplicate so we have a pointer to the original BZ.

Comment 3 Steve Grubb 2016-01-12 14:46:30 UTC

Bugzilla create 1296660 and 1296661 one right after another. I thought it would be cleaner to not link the two since looks like a bug in bugzilla.

Comment 4 Paul Moore 2016-01-12 16:57:30 UTC

I think having the link is still handy in case someone stumbles across this BZ and not the other.

*** This bug has been marked as a duplicate of bug 1296660 ***