auditctl filter keyword: "path"

Hey Steve,

audit-1.2.2-2 seems to be having problems with the path filter word.

# auditctl -a exit,always -S open -F path=bfile
Error sending add rule request (Invalid argument)
# auditctl -a entry,always -S open -F path=bfile
Error sending add rule request (Invalid argument)

I'm on kernel 27... Any idea on why this would be failing?

Thanks,
Mike

Apparently path will not take relative path names... Would it be desirable to augment the logic of auditctl to resolve the relative path and convert it to an absolute path for rule inclusion? This is a nice-to-have that admins will expect.

Thanks,
Mike