the PATH record

[Juraj Hlista]

Hello,

I need to get the absolute path from audit events. An audit event can
contain a relative path in the PATH record - if I concatenate the path
in the CWD record with the relative path in the PATH record, do I
always get the absolute path?

Also, some audit events contain more than one PATH record, for example:

type=SYSCALL msg=audit(1274190814.081:7): arch=c000003e syscall=165
success=yes exit=0 a0=1783fe0 a1=1784000 a2=1784020
a3=ffffffffc0ed0006 items=2 ppid=26725 pid=26726 auid=0 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
comm="mount" exe="/bin/mount" key=(null)
type=CWD msg=audit(1274190814.081:7):  cwd="/"
type=PATH msg=audit(1274190814.081:7): item=0 name="/media/flash"
inode=15592 dev=08:02 mode=040700 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1274190814.081:7): item=1 name=(null) inode=395117
dev=00:0c mode=060660 ouid=0 ogid=6 rdev=08:11

Is the first PATH record more important than the others? I need to get
the "/media/flash" from the audit event.