Hi Jan, I wanted to get your feedback on an idea I have been playing with. It started as a poor man's alternative to the old subtree watch problem. For my employer's use case, we are watching the entire filesystem using a filesystem mark, but would like to exclude events on a subtree (i.e. all files underneath .private/). At the moment, those events are filtered in userspace. I had considered adding directory marks with an ignored mask on every event that is received for a directory path under .private/, but that has the undesired side effect of pinning those directory inodes to cache. I have this old fsnotify-volatile branch [1] that I am using for an overlayfs kernel internal fsnotify backend. I wonder what are your thoughts on exposing this functionally to fanotify UAPI (i.e. FAN_MARK_VOLATILE). Thanks, Amir. [1] https://github.com/amir73il/linux/commits/fsnotify-volatile
