This patch fixes this by utilizing the open_how struct that we store while in the audit_context with audit_openat2_how(). unbiased of this patch, Richard male Briggs posted a similar patch into the audit mailing https://bookmarklinking.com/story3109946/not-known-facts-about-g-smoove