Displaying 1 result from an estimated 1 matches for "smb_full_audit_renam".
Did you mean:
smb_full_audit_rename
2018 Jul 25
0
vfs_audit log does not show full path names
...path = /home/usr
vfs objects = full_audit
Actual results:
ryan|$IP|sname|rename|ok|a/b/c.tmp|a/b/c.xlsx
ryan|$IP|sname|open|ok|r|c.xlsx
Expected results:
ryan|$IP|sname|rename|ok|a/b/c.tmp|a/b/c.xlsx
ryan|$IP|sname|open|ok|r|a/b/c.xlsx
Looking at vfs_full_audit.c, smb_full_audit_open() and
smb_full_audit_rename() are very similar, using smb_fname_str_do_log()
to format the file name string for logging. Apparently the difference is
at a higher level. Can we assume that the filename should be prefixed
with the current directory, or might the current directory have been
changed by the time the audit log is...