On Tue, 28 Jan 2025 at 13:42, Miklos Szeredi <miklos@xxxxxxxxxx> wrote: > fanotify_mark(fan_fd, FAN_MARK_ADD | FAN_MARK_MOUNT, FAN_OPEN, > AT_FDCWD, "/proc/self/ns/mnt"); Sorry, this should have been: 1) fanotify_mark(fan_fd, FAN_MARK_ADD | FAN_MARK_MNTNS, FAN_MNT_ATTACH | FAN_MNT_DETACH, AT_FDCWD, "/proc/self/ns/mnt"); This notifies on mount and unmount events in the current mount namespace.