[RFC] upstreaming audit filesystem pieces

[Amy Griffis]

Chris Wright wrote:     [Tue Aug 23 2005, 04:49:14PM EDT]
> > - The ability to begin watching a file at the moment of creation.
> >   Currently audit is pre-notified, via dcache hooks, when a file is
> >   created, moved, or deleted.  This allows audit to enable or disable
> >   a watch on the appropriate inode.  Audit would need a similar
> >   pre-notification, or preferably the ability to add (and possibly
> >   remove) watches from an Inotify event callback.
> 
> Inotify has a couple new dcache hooks, (iirc it's for delete), did you
> look at those yet?

I'm sorry about the delayed response, but yes, I've seen them.