1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _LINUX_FANOTIFY_H 3 #define _LINUX_FANOTIFY_H 4 5 #include <linux/sysctl.h> 6 #include <uapi/linux/fanotify.h> 7 8 #define FAN_GROUP_FLAG(group, flag) \ 9 ((group)->fanotify_data.flags & (flag)) 10 11 /* 12 * Flags allowed to be passed from/to userspace. 13 * 14 * We intentionally do not add new bits to the old FAN_ALL_* constants, because 15 * they are uapi exposed constants. If there are programs out there using 16 * these constant, the programs may break if re-compiled with new uapi headers 17 * and then run on an old kernel. 18 */ 19 20 /* Group classes where permission events are allowed */ 21 #define FANOTIFY_PERM_CLASSES (FAN_CLASS_CONTENT | \ 22 FAN_CLASS_PRE_CONTENT) 23 24 #define FANOTIFY_CLASS_BITS (FAN_CLASS_NOTIF | FANOTIFY_PERM_CLASSES) 25 26 #define FANOTIFY_FID_BITS (FAN_REPORT_DFID_NAME_TARGET) 27 28 #define FANOTIFY_INFO_MODES (FANOTIFY_FID_BITS | FAN_REPORT_PIDFD) 29 30 /* 31 * fanotify_init() flags that require CAP_SYS_ADMIN. 32 * We do not allow unprivileged groups to request permission events. 33 * We do not allow unprivileged groups to get other process pid in events. 34 * We do not allow unprivileged groups to use unlimited resources. 35 */ 36 #define FANOTIFY_ADMIN_INIT_FLAGS (FANOTIFY_PERM_CLASSES | \ 37 FAN_REPORT_TID | \ 38 FAN_REPORT_PIDFD | \ 39 FAN_REPORT_FD_ERROR | \ 40 FAN_UNLIMITED_QUEUE | \ 41 FAN_UNLIMITED_MARKS) 42 43 /* 44 * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN. 45 * FAN_CLASS_NOTIF is the only class we allow for unprivileged group. 46 * We do not allow unprivileged groups to get file descriptors in events, 47 * so one of the flags for reporting file handles is required. 48 */ 49 #define FANOTIFY_USER_INIT_FLAGS (FAN_CLASS_NOTIF | \ 50 FANOTIFY_FID_BITS | \ 51 FAN_CLOEXEC | FAN_NONBLOCK) 52 53 #define FANOTIFY_INIT_FLAGS (FANOTIFY_ADMIN_INIT_FLAGS | \ 54 FANOTIFY_USER_INIT_FLAGS) 55 56 /* Internal group flags */ 57 #define FANOTIFY_UNPRIV 0x80000000 58 #define FANOTIFY_INTERNAL_GROUP_FLAGS (FANOTIFY_UNPRIV) 59 60 #define FANOTIFY_MARK_TYPE_BITS (FAN_MARK_INODE | FAN_MARK_MOUNT | \ 61 FAN_MARK_FILESYSTEM) 62 63 #define FANOTIFY_MARK_CMD_BITS (FAN_MARK_ADD | FAN_MARK_REMOVE | \ 64 FAN_MARK_FLUSH) 65 66 #define FANOTIFY_MARK_IGNORE_BITS (FAN_MARK_IGNORED_MASK | \ 67 FAN_MARK_IGNORE) 68 69 #define FANOTIFY_MARK_FLAGS (FANOTIFY_MARK_TYPE_BITS | \ 70 FANOTIFY_MARK_CMD_BITS | \ 71 FANOTIFY_MARK_IGNORE_BITS | \ 72 FAN_MARK_DONT_FOLLOW | \ 73 FAN_MARK_ONLYDIR | \ 74 FAN_MARK_IGNORED_SURV_MODIFY | \ 75 FAN_MARK_EVICTABLE) 76 77 /* 78 * Events that can be reported with data type FSNOTIFY_EVENT_PATH. 79 * Note that FAN_MODIFY can also be reported with data type 80 * FSNOTIFY_EVENT_INODE. 81 */ 82 #define FANOTIFY_PATH_EVENTS (FAN_ACCESS | FAN_MODIFY | \ 83 FAN_CLOSE | FAN_OPEN | FAN_OPEN_EXEC) 84 85 /* 86 * Directory entry modification events - reported only to directory 87 * where entry is modified and not to a watching parent. 88 */ 89 #define FANOTIFY_DIRENT_EVENTS (FAN_MOVE | FAN_CREATE | FAN_DELETE | \ 90 FAN_RENAME) 91 92 /* Events that can be reported with event->fd */ 93 #define FANOTIFY_FD_EVENTS (FANOTIFY_PATH_EVENTS | FANOTIFY_PERM_EVENTS) 94 95 /* Events that can only be reported with data type FSNOTIFY_EVENT_INODE */ 96 #define FANOTIFY_INODE_EVENTS (FANOTIFY_DIRENT_EVENTS | \ 97 FAN_ATTRIB | FAN_MOVE_SELF | FAN_DELETE_SELF) 98 99 /* Events that can only be reported with data type FSNOTIFY_EVENT_ERROR */ 100 #define FANOTIFY_ERROR_EVENTS (FAN_FS_ERROR) 101 102 /* Events that user can request to be notified on */ 103 #define FANOTIFY_EVENTS (FANOTIFY_PATH_EVENTS | \ 104 FANOTIFY_INODE_EVENTS | \ 105 FANOTIFY_ERROR_EVENTS) 106 107 /* Events that require a permission response from user */ 108 #define FANOTIFY_PERM_EVENTS (FAN_OPEN_PERM | FAN_ACCESS_PERM | \ 109 FAN_OPEN_EXEC_PERM) 110 111 /* Extra flags that may be reported with event or control handling of events */ 112 #define FANOTIFY_EVENT_FLAGS (FAN_EVENT_ON_CHILD | FAN_ONDIR) 113 114 /* Events that may be reported to user */ 115 #define FANOTIFY_OUTGOING_EVENTS (FANOTIFY_EVENTS | \ 116 FANOTIFY_PERM_EVENTS | \ 117 FAN_Q_OVERFLOW | FAN_ONDIR) 118 119 /* Events and flags relevant only for directories */ 120 #define FANOTIFY_DIRONLY_EVENT_BITS (FANOTIFY_DIRENT_EVENTS | \ 121 FAN_EVENT_ON_CHILD | FAN_ONDIR) 122 123 #define ALL_FANOTIFY_EVENT_BITS (FANOTIFY_OUTGOING_EVENTS | \ 124 FANOTIFY_EVENT_FLAGS) 125 126 /* These masks check for invalid bits in permission responses. */ 127 #define FANOTIFY_RESPONSE_ACCESS (FAN_ALLOW | FAN_DENY) 128 #define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO) 129 #define FANOTIFY_RESPONSE_VALID_MASK (FANOTIFY_RESPONSE_ACCESS | FANOTIFY_RESPONSE_FLAGS) 130 131 /* Do not use these old uapi constants internally */ 132 #undef FAN_ALL_CLASS_BITS 133 #undef FAN_ALL_INIT_FLAGS 134 #undef FAN_ALL_MARK_FLAGS 135 #undef FAN_ALL_EVENTS 136 #undef FAN_ALL_PERM_EVENTS 137 #undef FAN_ALL_OUTGOING_EVENTS 138 139 #endif /* _LINUX_FANOTIFY_H */ 140