Rules for watching /tmp