Re: [PATCH ghak59 V3 4/4] audit: extend config_change mark/watch/tree rule changes

Give a clue as to the source of mark, watch and tree rule changes. See: https://github.com/linux-audit/audit-kernel/issues/50 See: https://github.com/linux-audit/audit-kernel/issues/59 Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- kernel/audit.h | 4 ++-- kernel/audit_fsnotify.c | 2 +- kernel/audit_tree.c | 24 ++++++++++++------------ kernel/audit_watch.c | 6 ++++-- kernel/auditsc.c | 4 ++-- 5 files changed, 21 insertions(+), 19 deletions(-)