Converting relative path to absolute path

Converting relative path to absolute path

[Aaron Lewis]

Hi,

If I access a file with relative path, the PATH audit message would be
a relative path as well.

I wonder if I can change this behavior without modifying the kernel?

(It seem audit daemon just receive the msg= field from kernel directly)

-- 
Best Regards,
Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E

Re: Converting relative path to absolute path

[Peter Moody]

On Thu, Dec 5, 2013 at 7:35 PM, Aaron Lewis <the.warl0ck.1989@gmail.com> wrote:
> Hi,
>
> If I access a file with relative path, the PATH audit message would be
> a relative path as well.
>
> I wonder if I can change this behavior without modifying the kernel?

IIUC, there should be a CWD message to go along with the PATH message.
You should be able to use that to find the absolute path

> (It seem audit daemon just receive the msg= field from kernel directly)
>
> --
> Best Regards,
> Aaron Lewis - PGP: 0xDFE6C29E ( http://keyserver.veridis.com )
> Finger Print: 9482 448F C7C3 896C 1DFE 7DD3 2492 A7D0 DFE6 C29E
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit



-- 
[ Peter Moody | Security Engineer | Google ]

Re: Converting relative path to absolute path

[Steve Grubb]

On Friday, December 06, 2013 08:42:44 AM Peter Moody wrote:
> > If I access a file with relative path, the PATH audit message would be
> > a relative path as well.
> > 
> > I wonder if I can change this behavior without modifying the kernel?
> 
> IIUC, there should be a CWD message to go along with the PATH message.
> You should be able to use that to find the absolute path

That is correct. What I do is take the cwd field and concatenate path and then 
run it through realpath(3) to finalize it.

-Steve