Re: open record looks like openat

[ramsdell@mitre.org (John D. Ramsdell)]

I notice that /bin/rm no longer uses the unlink system call, but
instead uses unlinkat.

Steve Grubb <sgrubb@redhat.com> writes:

> But openat does give a different output:

...

> Low and behold the record changes to this:

Note that my trick of looking at the last path record for the file
name works for both forms of openat events.  It also works with unlink
and unlinkat.

I guess I had better add programs that use openat to my test suite, so
as to ensure the trick works.

John