Absolute path names in PATH records

Steve Grubb sgrubb at redhat.com
Tue Jul 3 21:51:30 UTC 2007


On Monday 02 July 2007 04:43:47 pm John Dennis wrote:
> I'm not 100% positive, but I believe the work done to support
> AUDIT_AVC_PATH by capturing path information prior to sys call
> transition where only the inode is passed to the kernel will now result
> in complete path information in other audit records as well, perhaps
> Steve Grubb can give precise information on this.

Not to my knowledge. AFAIK, changes for AVC only affect AVC's and nothing 
else.

-Steve




More information about the Linux-audit mailing list