Hello,
Here is the patch that adds new functionality to the audit-0.6.9 as well as
changes some old. Patched against audit-0.6.9.
CHANGELOG
+ The major addition is the ability to "list" watches on a given directory.
-> Added AUDIT_WATCH_LST macro
+ Defined new -L option
-> Added a new "watch" field to the audit_reply struct
-> Added new function audit_list_watches() to libaudit
-> Added support for watch listing in auditctl
+ Gave ability for auditctl to receive AUDIT_WATCH_ERR messages
-> Made it so the kernel could send AUDIT_WATCH_ERR messages regarding
AUDIT_WATCH_INS/REM/LST in the same fashion.
+ Changed types in libaudit to be identical to the types of audit_watch in
audit.h
--
-tim