add_watch_to_parent 311 kernel/audit_watch.c goto add_watch_to_parent; /* event applies to a single watch */ add_watch_to_parent 316 kernel/audit_watch.c add_watch_to_parent: