FAN_AUDIT
if (event->response & FAN_AUDIT) {
audit_fanotify(response & ~FAN_AUDIT, &event->audit_rule);
if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT))
#define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO)