Re: linux-audit: reconstruct path names from syscall events?

If you see my recent linux-audit posting, another related thing (at least as far as missing relevant information in the logs) is that the audit logs are logging pathnames relative to the chroot, instead of the pathnames relative to the root of the OS itself. You'd expect a process chroot'd to /chroot, accessing (from the perspective of the OS) /chroot/etc/password would get logged as /chroot/etc/password but is rather logged as /etc/password. I don't have a working LXC install handy, but I'd imagine the audit subsystem would log relative to the container's / instead of the host's / too.