> > i don't think kauth is an appropriate framework for your purpose.
> > kern_subr.c "hooks", eventhandler, subr_callback.c are.
> > hook points should be somehow unified with VN_KNOTE, i guess.
> 
> The fileop scope, according to the Apple document, seems exactly
> for this purpose: file event notification.
> 
> If we won't be implementing it for this purpose, we'll probably
> not implement it at all. Is that the direction?

hm.  i didn't know that apple (ab)uses kauth for that purpose.
in any case, let's try to use/extend existing hook points, rather than
introducing a new sets.

YAMAMOTO Takashi