[RFC][PATCH 3/3] (#7U1) file system auditing

[Steve Grubb]

On Friday 22 April 2005 20:35, Timothy R. Chavez wrote:
> add a "delete all watches" feature in the user space tool (I
> think this is better done in the kernel, but...) -- what does everyone
> think?

Assuming I can get the watch list like syscall auditing, it can be done from 
user space. I'd like to keep some symmetry between syscall auditing and 
filesystem auditing. If you add a kernel function to do this for filesystem, 
there ought to be a function for syscall.

-Steve