"Wieprecht, Karen M." <[EMAIL PROTECTED]> writes: > I'm probably out of my league by responding here, but some syscall > records do have more than one path.
You are correct. I would expect the rename(2) system call to have two PATH records, and the renameat(4) call to have four. I suppose I should see what a renameat audit record looks like given Steve's interesting findings about openat. John -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
