On Fri, 9 Jun 2023 at 09:32, Amir Goldstein <amir73il@xxxxxxxxx> wrote: > > /proc/$pid/maps and /proc/$pid/exe contain display paths of mapped file. > audot and tomoyo also log the display path of the mapped exec file. /proc/PID/exe is based on task->mm->exe_file. AFAICS this will be the overlay file not the realfile, so it shouldn't need any special treatment. Same for tomoyo. Maybe I'm missing something? Thanks, Miklos
