Re: [RFC][PATCH 3/3] (#7U1) file system auditing
On Friday 22 April 2005 20:35, Timothy R. Chavez wrote:
add a "delete all watches" feature in the user space tool
(I
think this is better done in the kernel, but...) -- what does everyone
think?
Assuming I can get the watch list like syscall auditing, it can be done from
user space. I'd like to keep some symmetry between syscall auditing and
filesystem auditing. If you add a kernel function to do this for filesystem,
there ought to be a function for syscall.
-Steve