execve

[Steve Grubb]

Hello,

ran another test on .56 kernel. I wanted to make sure we are logging 
parameters for execve so we can see what is being executed:

type=PATH msg=audit(06/07/05 14:14:28.592:5004271) : item=1 inode=770531 
dev=03:02 mode=file,755 ouid=root ogid=root rdev=00:00
type=PATH msg=audit(06/07/05 14:14:28.592:5004271) : item=0 name=/bin/ls 
inode=1048599 dev=03:02 mode=file,755 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(06/07/05 14:14:28.592:5004271) :  cwd=/root
type=SYSCALL msg=audit(06/07/05 14:14:28.592:5004271) : arch=i386 
syscall=execve success=yes exit=0 a0=9195ab8 a1=91a9838 a2=91b1900 a3=91a9838 
items=2 pid=4167 auid=sgrubb uid=root gid=root euid=root suid=root fsuid=root 
egid=root sgid=root fsgid=root comm=ls exe=/bin/ls

What is the first PATH record showing? I was expecting only 1 item, not 2. 
There is no name, yet the mode says its a file. I've checked several apps 
doing execve, they all have the same first record with same inode no matter 
what I run.

-Steve