open record looks like openat

[John D. Ramsdell]

"Wieprecht, Karen M." <Karen.Wieprecht at jhuapl.edu> writes:

> I'm probably out of my league by responding here, but some syscall
> records do have more than one path.

You are correct.  I would expect the rename(2) system call to have two
PATH records, and the renameat(4) call to have four.  I suppose I
should see what a renameat audit record looks like given Steve's
interesting findings about openat.

John