{"action":"created","issue":{"url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/9","repository_url":"https://api.github.com/repos/linux-audit/audit-kernel","labels_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/9/comments","events_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/9/events","html_url":"https://github.com/linux-audit/audit-kernel/issues/9","id":146468767,"node_id":"MDU6SXNzdWUxNDY0Njg3Njc=","number":9,"title":"RFE: record the path of files accessed using the *at(2) syscalls","user":{"login":"pcmoore","id":8494929,"node_id":"MDQ6VXNlcjg0OTQ5Mjk=","avatar_url":"https://avatars0.githubusercontent.com/u/8494929?v=4","gravatar_id":"","url":"https://api.github.com/users/pcmoore","html_url":"https://github.com/pcmoore","followers_url":"https://api.github.com/users/pcmoore/followers","following_url":"https://api.github.com/users/pcmoore/following{/other_user}","gists_url":"https://api.github.com/users/pcmoore/gists{/gist_id}","starred_url":"https://api.github.com/users/pcmoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcmoore/subscriptions","organizations_url":"https://api.github.com/users/pcmoore/orgs","repos_url":"https://api.github.com/users/pcmoore/repos","events_url":"https://api.github.com/users/pcmoore/events{/privacy}","received_events_url":"https://api.github.com/users/pcmoore/received_events","type":"User","site_admin":false},"labels":[{"id":864901450,"node_id":"MDU6TGFiZWw4NjQ5MDE0NTA=","url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/difficulty/high","name":"difficulty/high","color":"0e8a16","default":false},{"id":331379351,"node_id":"MDU6TGFiZWwzMzEzNzkzNTE=","url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/enhancement","name":"enhancement","color":"84b6eb","default":true},{"id":386134165,"node_id":"MDU6TGFiZWwzODYxMzQxNjU=","url":"https://api.github.com/repos/linux-audit/audit-kernel/labels/priority/medium","name":"priority/medium","color":"fbda53","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-04-06T23:52:11Z","updated_at":"2018-12-04T08:38:11Z","closed_at":null,"author_association":"MEMBER","body":"For the *at syscalls, can we get the path from the FD being passed as an argument to be able to reconstruct what is being accessed? (Readlink in /proc/\\<pid\\>/fds/# shows the path, why can't this go into the record?) We may need a new auxiliary record type since this is neither the cwd or path.\r\n"},"comment":{"url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/comments/444016136","html_url":"https://github.com/linux-audit/audit-kernel/issues/9#issuecomment-444016136","issue_url":"https://api.github.com/repos/linux-audit/audit-kernel/issues/9","id":444016136,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDAxNjEzNg==","user":{"login":"WOnder93","id":3041388,"node_id":"MDQ6VXNlcjMwNDEzODg=","avatar_url":"https://avatars1.githubusercontent.com/u/3041388?v=4","gravatar_id":"","url":"https://api.github.com/users/WOnder93","html_url":"https://github.com/WOnder93","followers_url":"https://api.github.com/users/WOnder93/followers","following_url":"https://api.github.com/users/WOnder93/following{/other_user}","gists_url":"https://api.github.com/users/WOnder93/gists{/gist_id}","starred_url":"https://api.github.com/users/WOnder93/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WOnder93/subscriptions","organizations_url":"https://api.github.com/users/WOnder93/orgs","repos_url":"https://api.github.com/users/WOnder93/repos","events_url":"https://api.github.com/users/WOnder93/events{/privacy}","received_events_url":"https://api.github.com/users/WOnder93/received_events","type":"User","site_admin":false},"created_at":"2018-12-04T08:38:11Z","updated_at":"2018-12-04T08:38:11Z","author_association":"MEMBER","body":"@michael-skynorth That patchset only partially solves the problem. It adds records with some information that you can use to reconstruct the full path, but you'd have to do that manually. Basically, you'd need to look at the values of the fd arguments in the SYSCALL record, translate those to paths based on the FD_PATH records and then append the corresponding relative paths from the PATH records. You'd also need to watch out for the corner case from issue #95 (but that's easy to detect).\r\n\r\nAfter discussing the patchset we came to conclusion that this issue would be better resolved in a different way - ideally by providing full correct path in the PATH records. That solution doesn't need any changes in audit userspace, but will be a bit more difficult to implement. Currently there is an ongoing discussion about how exactly we want to solve the problem (see the thread related to issue #95 [1]-[5]) so it is unlikely we will have a solution before we come to an agreement on that.\r\n\r\n[1] https://www.redhat.com/archives/linux-audit/2018-August/msg00003.html\r\n[2] https://www.redhat.com/archives/linux-audit/2018-September/msg00027.html\r\n[3] https://www.redhat.com/archives/linux-audit/2018-October/msg00103.html\r\n[4] https://www.redhat.com/archives/linux-audit/2018-November/msg00005.html\r\n[5] https://www.redhat.com/archives/linux-audit/2018-December/msg00000.html"}}
{"actor":{"display_login":"WOnder93"}}