Re: open record looks like openat
"Wieprecht, Karen M." <Karen.Wieprecht(a)jhuapl.edu> writes:
I'm probably out of my league by responding here, but some
syscall
records do have more than one path.
You are correct. I would expect the rename(2) system call to have two
PATH records, and the renameat(4) call to have four. I suppose I
should see what a renameat audit record looks like given Steve's
interesting findings about openat.
John