Re: [PATCH 1/7] audit: convert audit watches to use fsnotify instead of inotify
On Fri, 2009-06-12 at 16:31 -0400, Eric Paris wrote:
Audit currently uses inotify to pin inodes in core and to detect
when
watched inodes are deleted or unmounted. This patch uses fsnotify instead
of inotify.
Signed-off-by: Eric Paris <eparis(a)redhat.com>
Sorry for being lazy and not googling around, but what changes between
inotify and fsnotify, specially in terms of filesystem auditing? Is
there any performance/features/usability changes?
Thanks,
-Klaus
--
Klaus Heinrich Kiwi <klausk(a)linux.vnet.ibm.com>
Linux Security Development, IBM Linux Technology Center