site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com In order: KAUTH_FILEOP_OPEN KAUTH_VNODE_READ_DATA KAUTH_FILEOP_CLOSE ...in other words, you will need to listen in more than one scope. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... On Aug 4, 2007, at 6:57 AM, Vishal Shetye wrote: Actually I intend to hook open system call and scope suitable for me is VNODE. Although KAUTH_VNODE_READ_DATA suffice the purpose, how would I differentiate between open and read. And what about close()? What notification should I receive? This email sent to site_archiver@lists.apple.com