AUDIT: Record working directory when syscall arguments are pathnames