Red Hat Bugzilla – Bug 1296661
RFE: audit of *at syscalls
Last modified: 2016-01-12 11:57:30 EST
Description of problem:
For the *at syscalls, can we get the path from the FD being passed as an argument to be able to reconstruct what is being accessed? (Readlink in /proc/<pid>/fds/# shows the path, why can't this go into the record? We may need a new auxiliary record type since this is neither the cwd or path.
This would be a big help since openat is used a lot.
Seems to be a duplicate...closing.
Then please mark this BZ as a duplicate so we have a pointer to the original BZ.
Bugzilla create 1296660 and 1296661 one right after another. I thought it would be cleaner to not link the two since looks like a bug in bugzilla.
I think having the link is still handy in case someone stumbles across this BZ and not the other.
*** This bug has been marked as a duplicate of bug 1296660 ***