add todo

1 files changed, 5 insertions, 0 deletions

diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..269ecf3
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,5 @@
+# TODO
+
+* Send PID and/or file pattern dynamically to the BPF program
+* Capture all *open* and *close* syscalls (e.g. from debugfs?)
+    * Could write a Go code to check for available syscalls and then alert?