Al, Please consider pulling audit fixes for 2.6.31. There are plenty more changes but they depend on the notification work to be pushed to Linus first. I'll send another pull request once that is done. -Eric The following changes since commit c9059598ea8981d02356eead3188bf7fa4d717b8: Linus Torvalds (1): Merge branch 'for-2.6.31' of git://git.kernel.dk/linux-2.6-block are available in the git repository at: git://git.infradead.org/users/eparis/audit.git for-next Eric Paris (11): Audit: fix audit watch use after free Audit: better estimation of execve record length Audit: dereferencing krule as if it were an audit_watch Audit: unify the printk of an skb when auditd not around Audit: cleanup netlink mesg handling Audit: clean up audit_receive_skb audit: seperate audit inode watches into a subfile Audit: move audit_get_nd completely into audit_watch audit: use kern_path rather than namei for watch creation Audit: clean up the audit_watch split Audit: clean up all op= output to include string quoting include/linux/audit.h | 3 + kernel/Makefile | 2 +- kernel/audit.c | 130 ++++++------ kernel/audit.h | 31 +-- kernel/audit_tree.c | 10 +- kernel/audit_watch.c | 541 ++++++++++++++++++++++++++++++++++++++++++++++++ kernel/auditfilter.c | 543 +++---------------------------------------------- kernel/auditsc.c | 17 +- 8 files changed, 660 insertions(+), 617 deletions(-) create mode 100644 kernel/audit_watch.c