On Wed, Mar 17, 2021 at 09:47:16PM -0400, Richard Guy Briggs wrote: > The openat2(2) syscall was added in v5.6. Add support for openat2 to the > audit syscall classifier and for recording openat2 parameters that cannot > be captured in the syscall parameters of the SYSCALL record. > > Supporting userspace code can be found in > https://github.com/rgbriggs/audit-userspace/tree/ghau-openat2 > > Supporting test case can be found in > https://github.com/linux-audit/audit-testsuite/pull/103 Seems sensible, thank you.