Re: [RFC] upstreaming audit filesystem pieces

> - The ability to begin watching a file at the moment of creation. > Currently audit is pre-notified, via dcache hooks, when a file is > created, moved, or deleted. This allows audit to enable or disable > a watch on the appropriate inode. Audit would need a similar > pre-notification, or preferably the ability to add (and possibly > remove) watches from an Inotify event callback. Inotify has a couple new dcache hooks, (iirc it's for delete), did you look at those yet?