Current directory for audit names.

David Woodhouse dwmw2 at infradead.org
Thu May 26 19:21:27 UTC 2005


On Thu, 2005-05-26 at 18:23 +0100, David Woodhouse wrote:
> We log pathnames which are passed as arguments to syscalls, but we don't
> actually record the current working directory, from which those
> pathnames are resolved. 

The patch obviously works a lot better if it doesn't for some reason
omit the bit where I added those two fields to the struct audit_context.
But you get the point, hopefully.

Kris, I assume there are no objections to this being in the next
released kernel? Path names aren't a great deal of use without the
working directory which they're generally relative to.

-- 
dwmw2




More information about the Linux-audit mailing list