On Mon, 17 Sep 2007 17:50:16 BST, Matthew Booth said: > I'm considering expanding argv[0] of EXECVE to be an absolute path.
I take it you mean "*an* absolute path that was valid when we cut the EXECVE record", and document that it may not be *the* actual path used? In a quarter century, I've just seen *too* many race conditions, tricks with ../symlink/foo links, and the like (including some interesting malware that would dynamically create a symlink and execve through it, just to frustrate attempts at figuring out which binary was being exploited).
pgpTtTuA07stF.pgp
Description: PGP signature
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
