Commit e9fd702a authored by Eric Paris's avatar Eric Paris

audit: convert audit watches to use fsnotify instead of inotify

Audit currently uses inotify to pin inodes in core and to detect when
watched inodes are deleted or unmounted.  This patch uses fsnotify instead
of inotify.
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent ae7b8f41
...@@ -58,9 +58,12 @@ ...@@ -58,9 +58,12 @@
FS_MOVED_FROM | FS_MOVED_TO | FS_CREATE |\ FS_MOVED_FROM | FS_MOVED_TO | FS_CREATE |\
FS_DELETE) FS_DELETE)
#define FS_MOVE (FS_MOVED_FROM | FS_MOVED_TO)
/* listeners that hard code group numbers near the top */ /* listeners that hard code group numbers near the top */
#define DNOTIFY_GROUP_NUM UINT_MAX #define DNOTIFY_GROUP_NUM UINT_MAX
#define INOTIFY_GROUP_NUM (DNOTIFY_GROUP_NUM-1) #define AUDIT_WATCH_GROUP_NUM (DNOTIFY_GROUP_NUM-1)
#define INOTIFY_GROUP_NUM (AUDIT_WATCH_GROUP_NUM-1)
struct fsnotify_group; struct fsnotify_group;
struct fsnotify_event; struct fsnotify_event;
......
This diff is collapsed.
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment