[RFC][PATCH 1/2] (#6 U2) filesystem auditing

[Steve Grubb]

On Monday 28 March 2005 20:54, Timothy R. Chavez wrote:
> + Added AUDIT_WATCH_LST support

Why not LIST instead of LST.

> + Added AUDIT_WATCH_ERR support - generic channel to send messages about
> watch actions to userspace; convert audit_receive_watch() to use this

I disagree with this whole approach. You should not create your own message 
call back. You should use the same one that every other packet type uses. 
Please just return the error back to audit_receive_msg. It should either 
return the error code directly or catch the error code in err. You do not 
need a type in the error message either. That should be readily appearant. If 
I'm inserting a rule, I should know the error was related to insert.

Was audit_receive_msg not returning an error message?

Thanks,
-Steve