Re: auditctl filter keyword: "path"

[Michael C Thompson <thompsmc@us.ibm.com>]

Michael C Thompson wrote:
> Hey Steve,
> 
> audit-1.2.2-2 seems to be having problems with the path filter word.
> 
> # auditctl -a exit,always -S open -F path=bfile
> Error sending add rule request (Invalid argument)
> # auditctl -a entry,always -S open -F path=bfile
> Error sending add rule request (Invalid argument)

Apparently path will not take relative path names... Would it be 
desirable to augment the logic of auditctl to resolve the relative path 
and convert it to an absolute path for rule inclusion? This is a 
nice-to-have that admins will expect.

Thanks,
Mike