site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Hi, all! Thanks in advance, - Maxim. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... I've been explorering the kauth FILEOP scope and found out, that for unexpectedly terminated or exit()'d process, which hadn't explicitly closed a file handle it was writing to, a KAUTH_FILEOP_CLOSE notification with KAUTH_FILEOP_CLOSE_MODIFIED flag set isn't issued. This happens, cause exit() closes all handles bypassing close() syscall, which actually checks flags and issues that kind of notifications. Are there any over documented means to get the same semantics for that kind of processes? This email sent to site_archiver@lists.apple.com