Description of problem: For the *at syscalls, can we get the path from the FD being passed as an argument to be able to reconstruct what is being accessed? (Readlink in /proc/<pid>/fds/# shows the path, why can't this go into the record? We may need a new auxiliary record type since this is neither the cwd or path. This would be a big help since openat is used a lot.
*** Bug 1296661 has been marked as a duplicate of this bug. ***
Upstream issue: * https://github.com/linux-audit/audit-kernel/issues/9
Closing this as we are tracking upstream RFEs on GitHub now, see the link in comment #2.