path watcher

[John Haxby]

Hello,

We have an internal group auditing updates to files but who would like
to be able to monitor the actual modification rather than the possible
intent to modify.

The example they gave is that some program opens a file
O_WRONLY|O_APPEND but in most cases it does not subsequently write to
the file.  For them, the usual auditctl -p path -w wa causes lots of
false positives.

Historically, I know, that -w wa is triggered by the open(2) flags
rather than actual modifications because "[t]he read & write syscalls
are omitted from this set since they would overwhelm the logs."  Reading
this again now, it looks a little specious as it seems quite easy to
overwhelm the logs anyway.

Is there any reason why a file watcher should not use the fsnotify
FS_ACCESS/MODIFY/ATTRIB masks before I go haring off to try to implement
that?

jch