I am writing the error cases for testing the PATH_MAX variables in auditctl. My general test case structure is as follows: 1- create directory /tmp/dirname_4085_long (using the syscall mkdir(directory, mode)) 2- attempt to add watch on /tmp/dirname_4085_long/files_ok_length (I am changing length of the file (within its NAME_MAX limit to make total strlen() add up to what I am testing for (>PATH_MAX, =PATH_MAX, =PATH_MAX+1, and =PATH_MAX-1 ) Problem: trying to create the directory in step 1 above fails (with errno 36 (ENAMETOOLONG)). Therefore I can't even add a watch on the file using that path (since the parent directory dirname_4085_long does not exist). In the fail cases (>PATH_MAX, and =PATH_MAX+1) auditctl catches the length issue first (so don't care much about the errno), and returns correct return code. However, in the cases where I am supposed to pass the auditctl (=PATH_MAX, and =PATH_MAX-1) and get to insert a watch, I get caught in the mkdir syscall check. auditctl is behaving correctly when it checks length of path, but it still returns an error because it is caught when actually trying to insert the watch and I get: Error sending watch insert request (File name too long) Error sending watch to kernel Anybody can think of a way to go around this and still test the =PATH_MAX, and =PATH_MAX-1 cases? thanks, - Loulwa