Red Hat Bugzilla – Bug 1296660
RFE: audit of *at syscalls
Last modified: 2016-06-02 15:41:47 EDT
Description of problem:
For the *at syscalls, can we get the path from the FD being passed as an argument to be able to reconstruct what is being accessed? (Readlink in /proc/<pid>/fds/# shows the path, why can't this go into the record? We may need a new auxiliary record type since this is neither the cwd or path.
This would be a big help since openat is used a lot.
*** Bug 1296661 has been marked as a duplicate of this bug. ***
Closing this as we are tracking upstream RFEs on GitHub now, see the link in comment #2.