Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _LINUX_FANOTIFY_H
3#define _LINUX_FANOTIFY_H
4
5#include <linux/sysctl.h>
6#include <uapi/linux/fanotify.h>
7
8#define FAN_GROUP_FLAG(group, flag) \
9 ((group)->fanotify_data.flags & (flag))
10
11/*
12 * Flags allowed to be passed from/to userspace.
13 *
14 * We intentionally do not add new bits to the old FAN_ALL_* constants, because
15 * they are uapi exposed constants. If there are programs out there using
16 * these constant, the programs may break if re-compiled with new uapi headers
17 * and then run on an old kernel.
18 */
19
20/* Group classes where permission events are allowed */
21#define FANOTIFY_PERM_CLASSES (FAN_CLASS_CONTENT | \
22 FAN_CLASS_PRE_CONTENT)
23
24#define FANOTIFY_CLASS_BITS (FAN_CLASS_NOTIF | FANOTIFY_PERM_CLASSES)
25
26#define FANOTIFY_FID_BITS (FAN_REPORT_DFID_NAME_TARGET)
27
28#define FANOTIFY_INFO_MODES (FANOTIFY_FID_BITS | FAN_REPORT_PIDFD | FAN_REPORT_MNT)
29
30/*
31 * fanotify_init() flags that require CAP_SYS_ADMIN.
32 * We do not allow unprivileged groups to request permission events.
33 * We do not allow unprivileged groups to get other process pid in events.
34 * We do not allow unprivileged groups to use unlimited resources.
35 */
36#define FANOTIFY_ADMIN_INIT_FLAGS (FANOTIFY_PERM_CLASSES | \
37 FAN_REPORT_TID | \
38 FAN_REPORT_PIDFD | \
39 FAN_REPORT_FD_ERROR | \
40 FAN_UNLIMITED_QUEUE | \
41 FAN_UNLIMITED_MARKS | \
42 FAN_REPORT_MNT)
43
44/*
45 * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN.
46 * FAN_CLASS_NOTIF is the only class we allow for unprivileged group.
47 * We do not allow unprivileged groups to get file descriptors in events,
48 * so one of the flags for reporting file handles is required.
49 */
50#define FANOTIFY_USER_INIT_FLAGS (FAN_CLASS_NOTIF | \
51 FANOTIFY_FID_BITS | \
52 FAN_CLOEXEC | FAN_NONBLOCK)
53
54#define FANOTIFY_INIT_FLAGS (FANOTIFY_ADMIN_INIT_FLAGS | \
55 FANOTIFY_USER_INIT_FLAGS)
56
57/* Internal group flags */
58#define FANOTIFY_UNPRIV 0x80000000
59#define FANOTIFY_INTERNAL_GROUP_FLAGS (FANOTIFY_UNPRIV)
60
61#define FANOTIFY_MARK_TYPE_BITS (FAN_MARK_INODE | FAN_MARK_MOUNT | \
62 FAN_MARK_FILESYSTEM | FAN_MARK_MNTNS)
63
64#define FANOTIFY_MARK_CMD_BITS (FAN_MARK_ADD | FAN_MARK_REMOVE | \
65 FAN_MARK_FLUSH)
66
67#define FANOTIFY_MARK_IGNORE_BITS (FAN_MARK_IGNORED_MASK | \
68 FAN_MARK_IGNORE)
69
70#define FANOTIFY_MARK_FLAGS (FANOTIFY_MARK_TYPE_BITS | \
71 FANOTIFY_MARK_CMD_BITS | \
72 FANOTIFY_MARK_IGNORE_BITS | \
73 FAN_MARK_DONT_FOLLOW | \
74 FAN_MARK_ONLYDIR | \
75 FAN_MARK_IGNORED_SURV_MODIFY | \
76 FAN_MARK_EVICTABLE)
77
78/*
79 * Events that can be reported with data type FSNOTIFY_EVENT_PATH.
80 * Note that FAN_MODIFY can also be reported with data type
81 * FSNOTIFY_EVENT_INODE.
82 */
83#define FANOTIFY_PATH_EVENTS (FAN_ACCESS | FAN_MODIFY | \
84 FAN_CLOSE | FAN_OPEN | FAN_OPEN_EXEC)
85
86/*
87 * Directory entry modification events - reported only to directory
88 * where entry is modified and not to a watching parent.
89 */
90#define FANOTIFY_DIRENT_EVENTS (FAN_MOVE | FAN_CREATE | FAN_DELETE | \
91 FAN_RENAME)
92
93/* Content events can be used to inspect file content */
94#define FANOTIFY_CONTENT_PERM_EVENTS (FAN_OPEN_PERM | FAN_OPEN_EXEC_PERM | \
95 FAN_ACCESS_PERM)
96/* Pre-content events can be used to fill file content */
97#define FANOTIFY_PRE_CONTENT_EVENTS (FAN_PRE_ACCESS)
98
99/* Events that require a permission response from user */
100#define FANOTIFY_PERM_EVENTS (FANOTIFY_CONTENT_PERM_EVENTS | \
101 FANOTIFY_PRE_CONTENT_EVENTS)
102
103/* Events that can be reported with event->fd */
104#define FANOTIFY_FD_EVENTS (FANOTIFY_PATH_EVENTS | FANOTIFY_PERM_EVENTS)
105
106/* Events that can only be reported with data type FSNOTIFY_EVENT_INODE */
107#define FANOTIFY_INODE_EVENTS (FANOTIFY_DIRENT_EVENTS | \
108 FAN_ATTRIB | FAN_MOVE_SELF | FAN_DELETE_SELF)
109
110/* Events that can only be reported with data type FSNOTIFY_EVENT_ERROR */
111#define FANOTIFY_ERROR_EVENTS (FAN_FS_ERROR)
112
113#define FANOTIFY_MOUNT_EVENTS (FAN_MNT_ATTACH | FAN_MNT_DETACH)
114
115/* Events that user can request to be notified on */
116#define FANOTIFY_EVENTS (FANOTIFY_PATH_EVENTS | \
117 FANOTIFY_INODE_EVENTS | \
118 FANOTIFY_ERROR_EVENTS | \
119 FANOTIFY_MOUNT_EVENTS)
120
121/* Extra flags that may be reported with event or control handling of events */
122#define FANOTIFY_EVENT_FLAGS (FAN_EVENT_ON_CHILD | FAN_ONDIR)
123
124/* Events that may be reported to user */
125#define FANOTIFY_OUTGOING_EVENTS (FANOTIFY_EVENTS | \
126 FANOTIFY_PERM_EVENTS | \
127 FAN_Q_OVERFLOW | FAN_ONDIR)
128
129/* Events and flags relevant only for directories */
130#define FANOTIFY_DIRONLY_EVENT_BITS (FANOTIFY_DIRENT_EVENTS | \
131 FAN_EVENT_ON_CHILD | FAN_ONDIR)
132
133#define ALL_FANOTIFY_EVENT_BITS (FANOTIFY_OUTGOING_EVENTS | \
134 FANOTIFY_EVENT_FLAGS)
135
136/* These masks check for invalid bits in permission responses. */
137#define FANOTIFY_RESPONSE_ACCESS (FAN_ALLOW | FAN_DENY)
138#define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO)
139#define FANOTIFY_RESPONSE_VALID_MASK \
140 (FANOTIFY_RESPONSE_ACCESS | FANOTIFY_RESPONSE_FLAGS | \
141 (FAN_ERRNO_MASK << FAN_ERRNO_SHIFT))
142
143/* Do not use these old uapi constants internally */
144#undef FAN_ALL_CLASS_BITS
145#undef FAN_ALL_INIT_FLAGS
146#undef FAN_ALL_MARK_FLAGS
147#undef FAN_ALL_EVENTS
148#undef FAN_ALL_PERM_EVENTS
149#undef FAN_ALL_OUTGOING_EVENTS
150
151#endif /* _LINUX_FANOTIFY_H */