1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/fanotify.h> 3 #include <linux/fcntl.h> 4 #include <linux/fdtable.h> 5 #include <linux/file.h> 6 #include <linux/fs.h> 7 #include <linux/anon_inodes.h> 8 #include <linux/fsnotify_backend.h> 9 #include <linux/init.h> 10 #include <linux/mount.h> 11 #include <linux/namei.h> 12 #include <linux/poll.h> 13 #include <linux/security.h> 14 #include <linux/syscalls.h> 15 #include <linux/slab.h> 16 #include <linux/types.h> 17 #include <linux/uaccess.h> 18 #include <linux/compat.h> 19 #include <linux/sched/signal.h> 20 #include <linux/memcontrol.h> 21 #include <linux/statfs.h> 22 #include <linux/exportfs.h> 23 24 #include <asm/ioctls.h> 25 26 #include "../../mount.h" 27 #include "../fdinfo.h" 28 #include "fanotify.h" 29 30 #define FANOTIFY_DEFAULT_MAX_EVENTS 16384 31 #define FANOTIFY_OLD_DEFAULT_MAX_MARKS 8192 32 #define FANOTIFY_DEFAULT_MAX_GROUPS 128 33 #define FANOTIFY_DEFAULT_FEE_POOL_SIZE 32 34 35 /* 36 * Legacy fanotify marks limits (8192) is per group and we introduced a tunable 37 * limit of marks per user, similar to inotify. Effectively, the legacy limit 38 * of fanotify marks per user is <max marks per group> * <max groups per user>. 39 * This default limit (1M) also happens to match the increased limit of inotify 40 * max_user_watches since v5.10. 41 */ 42 #define FANOTIFY_DEFAULT_MAX_USER_MARKS \ 43 (FANOTIFY_OLD_DEFAULT_MAX_MARKS * FANOTIFY_DEFAULT_MAX_GROUPS) 44 45 /* 46 * Most of the memory cost of adding an inode mark is pinning the marked inode. 47 * The size of the filesystem inode struct is not uniform across filesystems, 48 * so double the size of a VFS inode is used as a conservative approximation. 49 */ 50 #define INODE_MARK_COST (2 * sizeof(struct inode)) 51 52 /* configurable via /proc/sys/fs/fanotify/ */ 53 static int fanotify_max_queued_events __read_mostly; 54 55 #ifdef CONFIG_SYSCTL 56 57 #include <linux/sysctl.h> 58 59 static long ft_zero = 0; 60 static long ft_int_max = INT_MAX; 61 62 static struct ctl_table fanotify_table[] = { 63 { 64 .procname = "max_user_groups", 65 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS], 66 .maxlen = sizeof(long), 67 .mode = 0644, 68 .proc_handler = proc_doulongvec_minmax, 69 .extra1 = &ft_zero, 70 .extra2 = &ft_int_max, 71 }, 72 { 73 .procname = "max_user_marks", 74 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS], 75 .maxlen = sizeof(long), 76 .mode = 0644, 77 .proc_handler = proc_doulongvec_minmax, 78 .extra1 = &ft_zero, 79 .extra2 = &ft_int_max, 80 }, 81 { 82 .procname = "max_queued_events", 83 .data = &fanotify_max_queued_events, 84 .maxlen = sizeof(int), 85 .mode = 0644, 86 .proc_handler = proc_dointvec_minmax, 87 .extra1 = SYSCTL_ZERO 88 }, 89 { } 90 }; 91 92 static void __init fanotify_sysctls_init(void) 93 { 94 register_sysctl("fs/fanotify", fanotify_table); 95 } 96 #else 97 #define fanotify_sysctls_init() do { } while (0) 98 #endif /* CONFIG_SYSCTL */ 99 100 /* 101 * All flags that may be specified in parameter event_f_flags of fanotify_init. 102 * 103 * Internal and external open flags are stored together in field f_flags of 104 * struct file. Only external open flags shall be allowed in event_f_flags. 105 * Internal flags like FMODE_NONOTIFY, FMODE_EXEC, FMODE_NOCMTIME shall be 106 * excluded. 107 */ 108 #define FANOTIFY_INIT_ALL_EVENT_F_BITS ( \ 109 O_ACCMODE | O_APPEND | O_NONBLOCK | \ 110 __O_SYNC | O_DSYNC | O_CLOEXEC | \ 111 O_LARGEFILE | O_NOATIME ) 112 113 extern const struct fsnotify_ops fanotify_fsnotify_ops; 114 115 struct kmem_cache *fanotify_mark_cache __read_mostly; 116 struct kmem_cache *fanotify_fid_event_cachep __read_mostly; 117 struct kmem_cache *fanotify_path_event_cachep __read_mostly; 118 struct kmem_cache *fanotify_perm_event_cachep __read_mostly; 119 120 #define FANOTIFY_EVENT_ALIGN 4 121 #define FANOTIFY_FID_INFO_HDR_LEN \ 122 (sizeof(struct fanotify_event_info_fid) + sizeof(struct file_handle)) 123 #define FANOTIFY_PIDFD_INFO_HDR_LEN \ 124 sizeof(struct fanotify_event_info_pidfd) 125 #define FANOTIFY_ERROR_INFO_LEN \ 126 (sizeof(struct fanotify_event_info_error)) 127 128 static int fanotify_fid_info_len(int fh_len, int name_len) 129 { 130 int info_len = fh_len; 131 132 if (name_len) 133 info_len += name_len + 1; 134 135 return roundup(FANOTIFY_FID_INFO_HDR_LEN + info_len, 136 FANOTIFY_EVENT_ALIGN); 137 } 138 139 /* FAN_RENAME may have one or two dir+name info records */ 140 static int fanotify_dir_name_info_len(struct fanotify_event *event) 141 { 142 struct fanotify_info *info = fanotify_event_info(event); 143 int dir_fh_len = fanotify_event_dir_fh_len(event); 144 int dir2_fh_len = fanotify_event_dir2_fh_len(event); 145 int info_len = 0; 146 147 if (dir_fh_len) 148 info_len += fanotify_fid_info_len(dir_fh_len, 149 info->name_len); 150 if (dir2_fh_len) 151 info_len += fanotify_fid_info_len(dir2_fh_len, 152 info->name2_len); 153 154 return info_len; 155 } 156 157 static size_t fanotify_event_len(unsigned int info_mode, 158 struct fanotify_event *event) 159 { 160 size_t event_len = FAN_EVENT_METADATA_LEN; 161 int fh_len; 162 int dot_len = 0; 163 164 if (!info_mode) 165 return event_len; 166 167 if (fanotify_is_error_event(event->mask)) 168 event_len += FANOTIFY_ERROR_INFO_LEN; 169 170 if (fanotify_event_has_any_dir_fh(event)) { 171 event_len += fanotify_dir_name_info_len(event); 172 } else if ((info_mode & FAN_REPORT_NAME) && 173 (event->mask & FAN_ONDIR)) { 174 /* 175 * With group flag FAN_REPORT_NAME, if name was not recorded in 176 * event on a directory, we will report the name ".". 177 */ 178 dot_len = 1; 179 } 180 181 if (info_mode & FAN_REPORT_PIDFD) 182 event_len += FANOTIFY_PIDFD_INFO_HDR_LEN; 183 184 if (fanotify_event_has_object_fh(event)) { 185 fh_len = fanotify_event_object_fh_len(event); 186 event_len += fanotify_fid_info_len(fh_len, dot_len); 187 } 188 189 return event_len; 190 } 191 192 /* 193 * Remove an hashed event from merge hash table. 194 */ 195 static void fanotify_unhash_event(struct fsnotify_group *group, 196 struct fanotify_event *event) 197 { 198 assert_spin_locked(&group->notification_lock); 199 200 pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, 201 group, event, fanotify_event_hash_bucket(group, event)); 202 203 if (WARN_ON_ONCE(hlist_unhashed(&event->merge_list))) 204 return; 205 206 hlist_del_init(&event->merge_list); 207 } 208 209 /* 210 * Get an fanotify notification event if one exists and is small 211 * enough to fit in "count". Return an error pointer if the count 212 * is not large enough. When permission event is dequeued, its state is 213 * updated accordingly. 214 */ 215 static struct fanotify_event *get_one_event(struct fsnotify_group *group, 216 size_t count) 217 { 218 size_t event_size; 219 struct fanotify_event *event = NULL; 220 struct fsnotify_event *fsn_event; 221 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 222 223 pr_debug("%s: group=%p count=%zd\n", __func__, group, count); 224 225 spin_lock(&group->notification_lock); 226 fsn_event = fsnotify_peek_first_event(group); 227 if (!fsn_event) 228 goto out; 229 230 event = FANOTIFY_E(fsn_event); 231 event_size = fanotify_event_len(info_mode, event); 232 233 if (event_size > count) { 234 event = ERR_PTR(-EINVAL); 235 goto out; 236 } 237 238 /* 239 * Held the notification_lock the whole time, so this is the 240 * same event we peeked above. 241 */ 242 fsnotify_remove_first_event(group); 243 if (fanotify_is_perm_event(event->mask)) 244 FANOTIFY_PERM(event)->state = FAN_EVENT_REPORTED; 245 if (fanotify_is_hashed_event(event->mask)) 246 fanotify_unhash_event(group, event); 247 out: 248 spin_unlock(&group->notification_lock); 249 return event; 250 } 251 252 static int create_fd(struct fsnotify_group *group, const struct path *path, 253 struct file **file) 254 { 255 int client_fd; 256 struct file *new_file; 257 258 client_fd = get_unused_fd_flags(group->fanotify_data.f_flags); 259 if (client_fd < 0) 260 return client_fd; 261 262 /* 263 * we need a new file handle for the userspace program so it can read even if it was 264 * originally opened O_WRONLY. 265 */ 266 new_file = dentry_open(path, 267 group->fanotify_data.f_flags | __FMODE_NONOTIFY, 268 current_cred()); 269 if (IS_ERR(new_file)) { 270 put_unused_fd(client_fd); 271 client_fd = PTR_ERR(new_file); 272 } else { 273 *file = new_file; 274 } 275 276 return client_fd; 277 } 278 279 static int process_access_response_info(const char __user *info, 280 size_t info_len, 281 struct fanotify_response_info_audit_rule *friar) 282 { 283 if (info_len != sizeof(*friar)) 284 return -EINVAL; 285 286 if (copy_from_user(friar, info, sizeof(*friar))) 287 return -EFAULT; 288 289 if (friar->hdr.type != FAN_RESPONSE_INFO_AUDIT_RULE) 290 return -EINVAL; 291 if (friar->hdr.pad != 0) 292 return -EINVAL; 293 if (friar->hdr.len != sizeof(*friar)) 294 return -EINVAL; 295 296 return info_len; 297 } 298 299 /* 300 * Finish processing of permission event by setting it to ANSWERED state and 301 * drop group->notification_lock. 302 */ 303 static void finish_permission_event(struct fsnotify_group *group, 304 struct fanotify_perm_event *event, u32 response, 305 struct fanotify_response_info_audit_rule *friar) 306 __releases(&group->notification_lock) 307 { 308 bool destroy = false; 309 310 assert_spin_locked(&group->notification_lock); 311 event->response = response & ~FAN_INFO; 312 if (response & FAN_INFO) 313 memcpy(&event->audit_rule, friar, sizeof(*friar)); 314 315 if (event->state == FAN_EVENT_CANCELED) 316 destroy = true; 317 else 318 event->state = FAN_EVENT_ANSWERED; 319 spin_unlock(&group->notification_lock); 320 if (destroy) 321 fsnotify_destroy_event(group, &event->fae.fse); 322 } 323 324 static int process_access_response(struct fsnotify_group *group, 325 struct fanotify_response *response_struct, 326 const char __user *info, 327 size_t info_len) 328 { 329 struct fanotify_perm_event *event; 330 int fd = response_struct->fd; 331 u32 response = response_struct->response; 332 int ret = info_len; 333 struct fanotify_response_info_audit_rule friar; 334 335 pr_debug("%s: group=%p fd=%d response=%u buf=%p size=%zu\n", __func__, 336 group, fd, response, info, info_len); 337 /* 338 * make sure the response is valid, if invalid we do nothing and either 339 * userspace can send a valid response or we will clean it up after the 340 * timeout 341 */ 342 if (response & ~FANOTIFY_RESPONSE_VALID_MASK) 343 return -EINVAL; 344 345 switch (response & FANOTIFY_RESPONSE_ACCESS) { 346 case FAN_ALLOW: 347 case FAN_DENY: 348 break; 349 default: 350 return -EINVAL; 351 } 352 353 if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT)) 354 return -EINVAL; 355 356 if (response & FAN_INFO) { 357 ret = process_access_response_info(info, info_len, &friar); 358 if (ret < 0) 359 return ret; 360 if (fd == FAN_NOFD) 361 return ret; 362 } else { 363 ret = 0; 364 } 365 366 if (fd < 0) 367 return -EINVAL; 368 369 spin_lock(&group->notification_lock); 370 list_for_each_entry(event, &group->fanotify_data.access_list, 371 fae.fse.list) { 372 if (event->fd != fd) 373 continue; 374 375 list_del_init(&event->fae.fse.list); 376 finish_permission_event(group, event, response, &friar); 377 wake_up(&group->fanotify_data.access_waitq); 378 return ret; 379 } 380 spin_unlock(&group->notification_lock); 381 382 return -ENOENT; 383 } 384 385 static size_t copy_error_info_to_user(struct fanotify_event *event, 386 char __user *buf, int count) 387 { 388 struct fanotify_event_info_error info = { }; 389 struct fanotify_error_event *fee = FANOTIFY_EE(event); 390 391 info.hdr.info_type = FAN_EVENT_INFO_TYPE_ERROR; 392 info.hdr.len = FANOTIFY_ERROR_INFO_LEN; 393 394 if (WARN_ON(count < info.hdr.len)) 395 return -EFAULT; 396 397 info.error = fee->error; 398 info.error_count = fee->err_count; 399 400 if (copy_to_user(buf, &info, sizeof(info))) 401 return -EFAULT; 402 403 return info.hdr.len; 404 } 405 406 static int copy_fid_info_to_user(__kernel_fsid_t *fsid, struct fanotify_fh *fh, 407 int info_type, const char *name, 408 size_t name_len, 409 char __user *buf, size_t count) 410 { 411 struct fanotify_event_info_fid info = { }; 412 struct file_handle handle = { }; 413 unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh_buf; 414 size_t fh_len = fh ? fh->len : 0; 415 size_t info_len = fanotify_fid_info_len(fh_len, name_len); 416 size_t len = info_len; 417 418 pr_debug("%s: fh_len=%zu name_len=%zu, info_len=%zu, count=%zu\n", 419 __func__, fh_len, name_len, info_len, count); 420 421 if (WARN_ON_ONCE(len < sizeof(info) || len > count)) 422 return -EFAULT; 423 424 /* 425 * Copy event info fid header followed by variable sized file handle 426 * and optionally followed by variable sized filename. 427 */ 428 switch (info_type) { 429 case FAN_EVENT_INFO_TYPE_FID: 430 case FAN_EVENT_INFO_TYPE_DFID: 431 if (WARN_ON_ONCE(name_len)) 432 return -EFAULT; 433 break; 434 case FAN_EVENT_INFO_TYPE_DFID_NAME: 435 case FAN_EVENT_INFO_TYPE_OLD_DFID_NAME: 436 case FAN_EVENT_INFO_TYPE_NEW_DFID_NAME: 437 if (WARN_ON_ONCE(!name || !name_len)) 438 return -EFAULT; 439 break; 440 default: 441 return -EFAULT; 442 } 443 444 info.hdr.info_type = info_type; 445 info.hdr.len = len; 446 info.fsid = *fsid; 447 if (copy_to_user(buf, &info, sizeof(info))) 448 return -EFAULT; 449 450 buf += sizeof(info); 451 len -= sizeof(info); 452 if (WARN_ON_ONCE(len < sizeof(handle))) 453 return -EFAULT; 454 455 handle.handle_type = fh->type; 456 handle.handle_bytes = fh_len; 457 458 /* Mangle handle_type for bad file_handle */ 459 if (!fh_len) 460 handle.handle_type = FILEID_INVALID; 461 462 if (copy_to_user(buf, &handle, sizeof(handle))) 463 return -EFAULT; 464 465 buf += sizeof(handle); 466 len -= sizeof(handle); 467 if (WARN_ON_ONCE(len < fh_len)) 468 return -EFAULT; 469 470 /* 471 * For an inline fh and inline file name, copy through stack to exclude 472 * the copy from usercopy hardening protections. 473 */ 474 fh_buf = fanotify_fh_buf(fh); 475 if (fh_len <= FANOTIFY_INLINE_FH_LEN) { 476 memcpy(bounce, fh_buf, fh_len); 477 fh_buf = bounce; 478 } 479 if (copy_to_user(buf, fh_buf, fh_len)) 480 return -EFAULT; 481 482 buf += fh_len; 483 len -= fh_len; 484 485 if (name_len) { 486 /* Copy the filename with terminating null */ 487 name_len++; 488 if (WARN_ON_ONCE(len < name_len)) 489 return -EFAULT; 490 491 if (copy_to_user(buf, name, name_len)) 492 return -EFAULT; 493 494 buf += name_len; 495 len -= name_len; 496 } 497 498 /* Pad with 0's */ 499 WARN_ON_ONCE(len < 0 || len >= FANOTIFY_EVENT_ALIGN); 500 if (len > 0 && clear_user(buf, len)) 501 return -EFAULT; 502 503 return info_len; 504 } 505 506 static int copy_pidfd_info_to_user(int pidfd, 507 char __user *buf, 508 size_t count) 509 { 510 struct fanotify_event_info_pidfd info = { }; 511 size_t info_len = FANOTIFY_PIDFD_INFO_HDR_LEN; 512 513 if (WARN_ON_ONCE(info_len > count)) 514 return -EFAULT; 515 516 info.hdr.info_type = FAN_EVENT_INFO_TYPE_PIDFD; 517 info.hdr.len = info_len; 518 info.pidfd = pidfd; 519 520 if (copy_to_user(buf, &info, info_len)) 521 return -EFAULT; 522 523 return info_len; 524 } 525 526 static int copy_info_records_to_user(struct fanotify_event *event, 527 struct fanotify_info *info, 528 unsigned int info_mode, int pidfd, 529 char __user *buf, size_t count) 530 { 531 int ret, total_bytes = 0, info_type = 0; 532 unsigned int fid_mode = info_mode & FANOTIFY_FID_BITS; 533 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 534 535 /* 536 * Event info records order is as follows: 537 * 1. dir fid + name 538 * 2. (optional) new dir fid + new name 539 * 3. (optional) child fid 540 */ 541 if (fanotify_event_has_dir_fh(event)) { 542 info_type = info->name_len ? FAN_EVENT_INFO_TYPE_DFID_NAME : 543 FAN_EVENT_INFO_TYPE_DFID; 544 545 /* FAN_RENAME uses special info types */ 546 if (event->mask & FAN_RENAME) 547 info_type = FAN_EVENT_INFO_TYPE_OLD_DFID_NAME; 548 549 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 550 fanotify_info_dir_fh(info), 551 info_type, 552 fanotify_info_name(info), 553 info->name_len, buf, count); 554 if (ret < 0) 555 return ret; 556 557 buf += ret; 558 count -= ret; 559 total_bytes += ret; 560 } 561 562 /* New dir fid+name may be reported in addition to old dir fid+name */ 563 if (fanotify_event_has_dir2_fh(event)) { 564 info_type = FAN_EVENT_INFO_TYPE_NEW_DFID_NAME; 565 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 566 fanotify_info_dir2_fh(info), 567 info_type, 568 fanotify_info_name2(info), 569 info->name2_len, buf, count); 570 if (ret < 0) 571 return ret; 572 573 buf += ret; 574 count -= ret; 575 total_bytes += ret; 576 } 577 578 if (fanotify_event_has_object_fh(event)) { 579 const char *dot = NULL; 580 int dot_len = 0; 581 582 if (fid_mode == FAN_REPORT_FID || info_type) { 583 /* 584 * With only group flag FAN_REPORT_FID only type FID is 585 * reported. Second info record type is always FID. 586 */ 587 info_type = FAN_EVENT_INFO_TYPE_FID; 588 } else if ((fid_mode & FAN_REPORT_NAME) && 589 (event->mask & FAN_ONDIR)) { 590 /* 591 * With group flag FAN_REPORT_NAME, if name was not 592 * recorded in an event on a directory, report the name 593 * "." with info type DFID_NAME. 594 */ 595 info_type = FAN_EVENT_INFO_TYPE_DFID_NAME; 596 dot = "."; 597 dot_len = 1; 598 } else if ((event->mask & ALL_FSNOTIFY_DIRENT_EVENTS) || 599 (event->mask & FAN_ONDIR)) { 600 /* 601 * With group flag FAN_REPORT_DIR_FID, a single info 602 * record has type DFID for directory entry modification 603 * event and for event on a directory. 604 */ 605 info_type = FAN_EVENT_INFO_TYPE_DFID; 606 } else { 607 /* 608 * With group flags FAN_REPORT_DIR_FID|FAN_REPORT_FID, 609 * a single info record has type FID for event on a 610 * non-directory, when there is no directory to report. 611 * For example, on FAN_DELETE_SELF event. 612 */ 613 info_type = FAN_EVENT_INFO_TYPE_FID; 614 } 615 616 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 617 fanotify_event_object_fh(event), 618 info_type, dot, dot_len, 619 buf, count); 620 if (ret < 0) 621 return ret; 622 623 buf += ret; 624 count -= ret; 625 total_bytes += ret; 626 } 627 628 if (pidfd_mode) { 629 ret = copy_pidfd_info_to_user(pidfd, buf, count); 630 if (ret < 0) 631 return ret; 632 633 buf += ret; 634 count -= ret; 635 total_bytes += ret; 636 } 637 638 if (fanotify_is_error_event(event->mask)) { 639 ret = copy_error_info_to_user(event, buf, count); 640 if (ret < 0) 641 return ret; 642 buf += ret; 643 count -= ret; 644 total_bytes += ret; 645 } 646 647 return total_bytes; 648 } 649 650 static ssize_t copy_event_to_user(struct fsnotify_group *group, 651 struct fanotify_event *event, 652 char __user *buf, size_t count) 653 { 654 struct fanotify_event_metadata metadata; 655 const struct path *path = fanotify_event_path(event); 656 struct fanotify_info *info = fanotify_event_info(event); 657 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 658 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 659 struct file *f = NULL, *pidfd_file = NULL; 660 int ret, pidfd = -ESRCH, fd = -EBADF; 661 662 pr_debug("%s: group=%p event=%p\n", __func__, group, event); 663 664 metadata.event_len = fanotify_event_len(info_mode, event); 665 metadata.metadata_len = FAN_EVENT_METADATA_LEN; 666 metadata.vers = FANOTIFY_METADATA_VERSION; 667 metadata.reserved = 0; 668 metadata.mask = event->mask & FANOTIFY_OUTGOING_EVENTS; 669 metadata.pid = pid_vnr(event->pid); 670 /* 671 * For an unprivileged listener, event->pid can be used to identify the 672 * events generated by the listener process itself, without disclosing 673 * the pids of other processes. 674 */ 675 if (FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 676 task_tgid(current) != event->pid) 677 metadata.pid = 0; 678 679 /* 680 * For now, fid mode is required for an unprivileged listener and 681 * fid mode does not report fd in events. Keep this check anyway 682 * for safety in case fid mode requirement is relaxed in the future 683 * to allow unprivileged listener to get events with no fd and no fid. 684 */ 685 if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 686 path && path->mnt && path->dentry) { 687 fd = create_fd(group, path, &f); 688 /* 689 * Opening an fd from dentry can fail for several reasons. 690 * For example, when tasks are gone and we try to open their 691 * /proc files or we try to open a WRONLY file like in sysfs 692 * or when trying to open a file that was deleted on the 693 * remote network server. 694 * 695 * For a group with FAN_REPORT_FD_ERROR, we will send the 696 * event with the error instead of the open fd, otherwise 697 * Userspace may not get the error at all. 698 * In any case, userspace will not know which file failed to 699 * open, so add a debug print for further investigation. 700 */ 701 if (fd < 0) { 702 pr_debug("fanotify: create_fd(%pd2) failed err=%d\n", 703 path->dentry, fd); 704 if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) { 705 /* 706 * Historically, we've handled EOPENSTALE in a 707 * special way and silently dropped such 708 * events. Now we have to keep it to maintain 709 * backward compatibility... 710 */ 711 if (fd == -EOPENSTALE) 712 fd = 0; 713 return fd; 714 } 715 } 716 } 717 if (FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) 718 metadata.fd = fd; 719 else 720 metadata.fd = fd >= 0 ? fd : FAN_NOFD; 721 722 if (pidfd_mode) { 723 /* 724 * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual 725 * exclusion is ever lifted. At the time of incoporating pidfd 726 * support within fanotify, the pidfd API only supported the 727 * creation of pidfds for thread-group leaders. 728 */ 729 WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID)); 730 731 /* 732 * The PIDTYPE_TGID check for an event->pid is performed 733 * preemptively in an attempt to catch out cases where the event 734 * listener reads events after the event generating process has 735 * already terminated. Depending on flag FAN_REPORT_FD_ERROR, 736 * report either -ESRCH or FAN_NOPIDFD to the event listener in 737 * those cases with all other pidfd creation errors reported as 738 * the error code itself or as FAN_EPIDFD. 739 */ 740 if (metadata.pid && pid_has_task(event->pid, PIDTYPE_TGID)) 741 pidfd = pidfd_prepare(event->pid, 0, &pidfd_file); 742 743 if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0) 744 pidfd = pidfd == -ESRCH ? FAN_NOPIDFD : FAN_EPIDFD; 745 } 746 747 ret = -EFAULT; 748 /* 749 * Sanity check copy size in case get_one_event() and 750 * event_len sizes ever get out of sync. 751 */ 752 if (WARN_ON_ONCE(metadata.event_len > count)) 753 goto out_close_fd; 754 755 if (copy_to_user(buf, &metadata, FAN_EVENT_METADATA_LEN)) 756 goto out_close_fd; 757 758 buf += FAN_EVENT_METADATA_LEN; 759 count -= FAN_EVENT_METADATA_LEN; 760 761 if (info_mode) { 762 ret = copy_info_records_to_user(event, info, info_mode, pidfd, 763 buf, count); 764 if (ret < 0) 765 goto out_close_fd; 766 } 767 768 if (f) 769 fd_install(fd, f); 770 771 if (pidfd_file) 772 fd_install(pidfd, pidfd_file); 773 774 if (fanotify_is_perm_event(event->mask)) 775 FANOTIFY_PERM(event)->fd = fd; 776 777 return metadata.event_len; 778 779 out_close_fd: 780 if (f) { 781 put_unused_fd(fd); 782 fput(f); 783 } 784 785 if (pidfd_file) { 786 put_unused_fd(pidfd); 787 fput(pidfd_file); 788 } 789 790 return ret; 791 } 792 793 /* intofiy userspace file descriptor functions */ 794 static __poll_t fanotify_poll(struct file *file, poll_table *wait) 795 { 796 struct fsnotify_group *group = file->private_data; 797 __poll_t ret = 0; 798 799 poll_wait(file, &group->notification_waitq, wait); 800 spin_lock(&group->notification_lock); 801 if (!fsnotify_notify_queue_is_empty(group)) 802 ret = EPOLLIN | EPOLLRDNORM; 803 spin_unlock(&group->notification_lock); 804 805 return ret; 806 } 807 808 static ssize_t fanotify_read(struct file *file, char __user *buf, 809 size_t count, loff_t *pos) 810 { 811 struct fsnotify_group *group; 812 struct fanotify_event *event; 813 char __user *start; 814 int ret; 815 DEFINE_WAIT_FUNC(wait, woken_wake_function); 816 817 start = buf; 818 group = file->private_data; 819 820 pr_debug("%s: group=%p\n", __func__, group); 821 822 add_wait_queue(&group->notification_waitq, &wait); 823 while (1) { 824 /* 825 * User can supply arbitrarily large buffer. Avoid softlockups 826 * in case there are lots of available events. 827 */ 828 cond_resched(); 829 event = get_one_event(group, count); 830 if (IS_ERR(event)) { 831 ret = PTR_ERR(event); 832 break; 833 } 834 835 if (!event) { 836 ret = -EAGAIN; 837 if (file->f_flags & O_NONBLOCK) 838 break; 839 840 ret = -ERESTARTSYS; 841 if (signal_pending(current)) 842 break; 843 844 if (start != buf) 845 break; 846 847 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 848 continue; 849 } 850 851 ret = copy_event_to_user(group, event, buf, count); 852 853 /* 854 * Permission events get queued to wait for response. Other 855 * events can be destroyed now. 856 */ 857 if (!fanotify_is_perm_event(event->mask)) { 858 fsnotify_destroy_event(group, &event->fse); 859 } else { 860 if (ret <= 0 || FANOTIFY_PERM(event)->fd < 0) { 861 spin_lock(&group->notification_lock); 862 finish_permission_event(group, 863 FANOTIFY_PERM(event), FAN_DENY, NULL); 864 wake_up(&group->fanotify_data.access_waitq); 865 } else { 866 spin_lock(&group->notification_lock); 867 list_add_tail(&event->fse.list, 868 &group->fanotify_data.access_list); 869 spin_unlock(&group->notification_lock); 870 } 871 } 872 if (ret < 0) 873 break; 874 buf += ret; 875 count -= ret; 876 } 877 remove_wait_queue(&group->notification_waitq, &wait); 878 879 if (start != buf && ret != -EFAULT) 880 ret = buf - start; 881 return ret; 882 } 883 884 static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos) 885 { 886 struct fanotify_response response; 887 struct fsnotify_group *group; 888 int ret; 889 const char __user *info_buf = buf + sizeof(struct fanotify_response); 890 size_t info_len; 891 892 if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 893 return -EINVAL; 894 895 group = file->private_data; 896 897 pr_debug("%s: group=%p count=%zu\n", __func__, group, count); 898 899 if (count < sizeof(response)) 900 return -EINVAL; 901 902 if (copy_from_user(&response, buf, sizeof(response))) 903 return -EFAULT; 904 905 info_len = count - sizeof(response); 906 907 ret = process_access_response(group, &response, info_buf, info_len); 908 if (ret < 0) 909 count = ret; 910 else 911 count = sizeof(response) + ret; 912 913 return count; 914 } 915 916 static int fanotify_release(struct inode *ignored, struct file *file) 917 { 918 struct fsnotify_group *group = file->private_data; 919 struct fsnotify_event *fsn_event; 920 921 /* 922 * Stop new events from arriving in the notification queue. since 923 * userspace cannot use fanotify fd anymore, no event can enter or 924 * leave access_list by now either. 925 */ 926 fsnotify_group_stop_queueing(group); 927 928 /* 929 * Process all permission events on access_list and notification queue 930 * and simulate reply from userspace. 931 */ 932 spin_lock(&group->notification_lock); 933 while (!list_empty(&group->fanotify_data.access_list)) { 934 struct fanotify_perm_event *event; 935 936 event = list_first_entry(&group->fanotify_data.access_list, 937 struct fanotify_perm_event, fae.fse.list); 938 list_del_init(&event->fae.fse.list); 939 finish_permission_event(group, event, FAN_ALLOW, NULL); 940 spin_lock(&group->notification_lock); 941 } 942 943 /* 944 * Destroy all non-permission events. For permission events just 945 * dequeue them and set the response. They will be freed once the 946 * response is consumed and fanotify_get_response() returns. 947 */ 948 while ((fsn_event = fsnotify_remove_first_event(group))) { 949 struct fanotify_event *event = FANOTIFY_E(fsn_event); 950 951 if (!(event->mask & FANOTIFY_PERM_EVENTS)) { 952 spin_unlock(&group->notification_lock); 953 fsnotify_destroy_event(group, fsn_event); 954 } else { 955 finish_permission_event(group, FANOTIFY_PERM(event), 956 FAN_ALLOW, NULL); 957 } 958 spin_lock(&group->notification_lock); 959 } 960 spin_unlock(&group->notification_lock); 961 962 /* Response for all permission events it set, wakeup waiters */ 963 wake_up(&group->fanotify_data.access_waitq); 964 965 /* matches the fanotify_init->fsnotify_alloc_group */ 966 fsnotify_destroy_group(group); 967 968 return 0; 969 } 970 971 static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 972 { 973 struct fsnotify_group *group; 974 struct fsnotify_event *fsn_event; 975 void __user *p; 976 int ret = -ENOTTY; 977 size_t send_len = 0; 978 979 group = file->private_data; 980 981 p = (void __user *) arg; 982 983 switch (cmd) { 984 case FIONREAD: 985 spin_lock(&group->notification_lock); 986 list_for_each_entry(fsn_event, &group->notification_list, list) 987 send_len += FAN_EVENT_METADATA_LEN; 988 spin_unlock(&group->notification_lock); 989 ret = put_user(send_len, (int __user *) p); 990 break; 991 } 992 993 return ret; 994 } 995 996 static const struct file_operations fanotify_fops = { 997 .show_fdinfo = fanotify_show_fdinfo, 998 .poll = fanotify_poll, 999 .read = fanotify_read, 1000 .write = fanotify_write, 1001 .fasync = NULL, 1002 .release = fanotify_release, 1003 .unlocked_ioctl = fanotify_ioctl, 1004 .compat_ioctl = compat_ptr_ioctl, 1005 .llseek = noop_llseek, 1006 }; 1007 1008 static int fanotify_find_path(int dfd, const char __user *filename, 1009 struct path *path, unsigned int flags, __u64 mask, 1010 unsigned int obj_type) 1011 { 1012 int ret; 1013 1014 pr_debug("%s: dfd=%d filename=%p flags=%x\n", __func__, 1015 dfd, filename, flags); 1016 1017 if (filename == NULL) { 1018 struct fd f = fdget(dfd); 1019 1020 ret = -EBADF; 1021 if (!f.file) 1022 goto out; 1023 1024 ret = -ENOTDIR; 1025 if ((flags & FAN_MARK_ONLYDIR) && 1026 !(S_ISDIR(file_inode(f.file)->i_mode))) { 1027 fdput(f); 1028 goto out; 1029 } 1030 1031 *path = f.file->f_path; 1032 path_get(path); 1033 fdput(f); 1034 } else { 1035 unsigned int lookup_flags = 0; 1036 1037 if (!(flags & FAN_MARK_DONT_FOLLOW)) 1038 lookup_flags |= LOOKUP_FOLLOW; 1039 if (flags & FAN_MARK_ONLYDIR) 1040 lookup_flags |= LOOKUP_DIRECTORY; 1041 1042 ret = user_path_at(dfd, filename, lookup_flags, path); 1043 if (ret) 1044 goto out; 1045 } 1046 1047 /* you can only watch an inode if you have read permissions on it */ 1048 ret = path_permission(path, MAY_READ); 1049 if (ret) { 1050 path_put(path); 1051 goto out; 1052 } 1053 1054 ret = security_path_notify(path, mask, obj_type); 1055 if (ret) 1056 path_put(path); 1057 1058 out: 1059 return ret; 1060 } 1061 1062 static __u32 fanotify_mark_remove_from_mask(struct fsnotify_mark *fsn_mark, 1063 __u32 mask, unsigned int flags, 1064 __u32 umask, int *destroy) 1065 { 1066 __u32 oldmask, newmask; 1067 1068 /* umask bits cannot be removed by user */ 1069 mask &= ~umask; 1070 spin_lock(&fsn_mark->lock); 1071 oldmask = fsnotify_calc_mask(fsn_mark); 1072 if (!(flags & FANOTIFY_MARK_IGNORE_BITS)) { 1073 fsn_mark->mask &= ~mask; 1074 } else { 1075 fsn_mark->ignore_mask &= ~mask; 1076 } 1077 newmask = fsnotify_calc_mask(fsn_mark); 1078 /* 1079 * We need to keep the mark around even if remaining mask cannot 1080 * result in any events (e.g. mask == FAN_ONDIR) to support incremenal 1081 * changes to the mask. 1082 * Destroy mark when only umask bits remain. 1083 */ 1084 *destroy = !((fsn_mark->mask | fsn_mark->ignore_mask) & ~umask); 1085 spin_unlock(&fsn_mark->lock); 1086 1087 return oldmask & ~newmask; 1088 } 1089 1090 static int fanotify_remove_mark(struct fsnotify_group *group, 1091 fsnotify_connp_t *connp, __u32 mask, 1092 unsigned int flags, __u32 umask) 1093 { 1094 struct fsnotify_mark *fsn_mark = NULL; 1095 __u32 removed; 1096 int destroy_mark; 1097 1098 fsnotify_group_lock(group); 1099 fsn_mark = fsnotify_find_mark(connp, group); 1100 if (!fsn_mark) { 1101 fsnotify_group_unlock(group); 1102 return -ENOENT; 1103 } 1104 1105 removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags, 1106 umask, &destroy_mark); 1107 if (removed & fsnotify_conn_mask(fsn_mark->connector)) 1108 fsnotify_recalc_mask(fsn_mark->connector); 1109 if (destroy_mark) 1110 fsnotify_detach_mark(fsn_mark); 1111 fsnotify_group_unlock(group); 1112 if (destroy_mark) 1113 fsnotify_free_mark(fsn_mark); 1114 1115 /* matches the fsnotify_find_mark() */ 1116 fsnotify_put_mark(fsn_mark); 1117 return 0; 1118 } 1119 1120 static int fanotify_remove_vfsmount_mark(struct fsnotify_group *group, 1121 struct vfsmount *mnt, __u32 mask, 1122 unsigned int flags, __u32 umask) 1123 { 1124 return fanotify_remove_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, 1125 mask, flags, umask); 1126 } 1127 1128 static int fanotify_remove_sb_mark(struct fsnotify_group *group, 1129 struct super_block *sb, __u32 mask, 1130 unsigned int flags, __u32 umask) 1131 { 1132 return fanotify_remove_mark(group, &sb->s_fsnotify_marks, mask, 1133 flags, umask); 1134 } 1135 1136 static int fanotify_remove_inode_mark(struct fsnotify_group *group, 1137 struct inode *inode, __u32 mask, 1138 unsigned int flags, __u32 umask) 1139 { 1140 return fanotify_remove_mark(group, &inode->i_fsnotify_marks, mask, 1141 flags, umask); 1142 } 1143 1144 static bool fanotify_mark_update_flags(struct fsnotify_mark *fsn_mark, 1145 unsigned int fan_flags) 1146 { 1147 bool want_iref = !(fan_flags & FAN_MARK_EVICTABLE); 1148 unsigned int ignore = fan_flags & FANOTIFY_MARK_IGNORE_BITS; 1149 bool recalc = false; 1150 1151 /* 1152 * When using FAN_MARK_IGNORE for the first time, mark starts using 1153 * independent event flags in ignore mask. After that, trying to 1154 * update the ignore mask with the old FAN_MARK_IGNORED_MASK API 1155 * will result in EEXIST error. 1156 */ 1157 if (ignore == FAN_MARK_IGNORE) 1158 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS; 1159 1160 /* 1161 * Setting FAN_MARK_IGNORED_SURV_MODIFY for the first time may lead to 1162 * the removal of the FS_MODIFY bit in calculated mask if it was set 1163 * because of an ignore mask that is now going to survive FS_MODIFY. 1164 */ 1165 if (ignore && (fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1166 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY)) { 1167 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY; 1168 if (!(fsn_mark->mask & FS_MODIFY)) 1169 recalc = true; 1170 } 1171 1172 if (fsn_mark->connector->type != FSNOTIFY_OBJ_TYPE_INODE || 1173 want_iref == !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1174 return recalc; 1175 1176 /* 1177 * NO_IREF may be removed from a mark, but not added. 1178 * When removed, fsnotify_recalc_mask() will take the inode ref. 1179 */ 1180 WARN_ON_ONCE(!want_iref); 1181 fsn_mark->flags &= ~FSNOTIFY_MARK_FLAG_NO_IREF; 1182 1183 return true; 1184 } 1185 1186 static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark, 1187 __u32 mask, unsigned int fan_flags) 1188 { 1189 bool recalc; 1190 1191 spin_lock(&fsn_mark->lock); 1192 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS)) 1193 fsn_mark->mask |= mask; 1194 else 1195 fsn_mark->ignore_mask |= mask; 1196 1197 recalc = fsnotify_calc_mask(fsn_mark) & 1198 ~fsnotify_conn_mask(fsn_mark->connector); 1199 1200 recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags); 1201 spin_unlock(&fsn_mark->lock); 1202 1203 return recalc; 1204 } 1205 1206 static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group, 1207 fsnotify_connp_t *connp, 1208 unsigned int obj_type, 1209 unsigned int fan_flags, 1210 __kernel_fsid_t *fsid) 1211 { 1212 struct ucounts *ucounts = group->fanotify_data.ucounts; 1213 struct fsnotify_mark *mark; 1214 int ret; 1215 1216 /* 1217 * Enforce per user marks limits per user in all containing user ns. 1218 * A group with FAN_UNLIMITED_MARKS does not contribute to mark count 1219 * in the limited groups account. 1220 */ 1221 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) && 1222 !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS)) 1223 return ERR_PTR(-ENOSPC); 1224 1225 mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL); 1226 if (!mark) { 1227 ret = -ENOMEM; 1228 goto out_dec_ucounts; 1229 } 1230 1231 fsnotify_init_mark(mark, group); 1232 if (fan_flags & FAN_MARK_EVICTABLE) 1233 mark->flags |= FSNOTIFY_MARK_FLAG_NO_IREF; 1234 1235 ret = fsnotify_add_mark_locked(mark, connp, obj_type, 0, fsid); 1236 if (ret) { 1237 fsnotify_put_mark(mark); 1238 goto out_dec_ucounts; 1239 } 1240 1241 return mark; 1242 1243 out_dec_ucounts: 1244 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS)) 1245 dec_ucount(ucounts, UCOUNT_FANOTIFY_MARKS); 1246 return ERR_PTR(ret); 1247 } 1248 1249 static int fanotify_group_init_error_pool(struct fsnotify_group *group) 1250 { 1251 if (mempool_initialized(&group->fanotify_data.error_events_pool)) 1252 return 0; 1253 1254 return mempool_init_kmalloc_pool(&group->fanotify_data.error_events_pool, 1255 FANOTIFY_DEFAULT_FEE_POOL_SIZE, 1256 sizeof(struct fanotify_error_event)); 1257 } 1258 1259 static int fanotify_may_update_existing_mark(struct fsnotify_mark *fsn_mark, 1260 unsigned int fan_flags) 1261 { 1262 /* 1263 * Non evictable mark cannot be downgraded to evictable mark. 1264 */ 1265 if (fan_flags & FAN_MARK_EVICTABLE && 1266 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1267 return -EEXIST; 1268 1269 /* 1270 * New ignore mask semantics cannot be downgraded to old semantics. 1271 */ 1272 if (fan_flags & FAN_MARK_IGNORED_MASK && 1273 fsn_mark->flags & FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS) 1274 return -EEXIST; 1275 1276 /* 1277 * An ignore mask that survives modify could never be downgraded to not 1278 * survive modify. With new FAN_MARK_IGNORE semantics we make that rule 1279 * explicit and return an error when trying to update the ignore mask 1280 * without the original FAN_MARK_IGNORED_SURV_MODIFY value. 1281 */ 1282 if (fan_flags & FAN_MARK_IGNORE && 1283 !(fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1284 fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY) 1285 return -EEXIST; 1286 1287 return 0; 1288 } 1289 1290 static int fanotify_add_mark(struct fsnotify_group *group, 1291 fsnotify_connp_t *connp, unsigned int obj_type, 1292 __u32 mask, unsigned int fan_flags, 1293 __kernel_fsid_t *fsid) 1294 { 1295 struct fsnotify_mark *fsn_mark; 1296 bool recalc; 1297 int ret = 0; 1298 1299 fsnotify_group_lock(group); 1300 fsn_mark = fsnotify_find_mark(connp, group); 1301 if (!fsn_mark) { 1302 fsn_mark = fanotify_add_new_mark(group, connp, obj_type, 1303 fan_flags, fsid); 1304 if (IS_ERR(fsn_mark)) { 1305 fsnotify_group_unlock(group); 1306 return PTR_ERR(fsn_mark); 1307 } 1308 } 1309 1310 /* 1311 * Check if requested mark flags conflict with an existing mark flags. 1312 */ 1313 ret = fanotify_may_update_existing_mark(fsn_mark, fan_flags); 1314 if (ret) 1315 goto out; 1316 1317 /* 1318 * Error events are pre-allocated per group, only if strictly 1319 * needed (i.e. FAN_FS_ERROR was requested). 1320 */ 1321 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS) && 1322 (mask & FAN_FS_ERROR)) { 1323 ret = fanotify_group_init_error_pool(group); 1324 if (ret) 1325 goto out; 1326 } 1327 1328 recalc = fanotify_mark_add_to_mask(fsn_mark, mask, fan_flags); 1329 if (recalc) 1330 fsnotify_recalc_mask(fsn_mark->connector); 1331 1332 out: 1333 fsnotify_group_unlock(group); 1334 1335 fsnotify_put_mark(fsn_mark); 1336 return ret; 1337 } 1338 1339 static int fanotify_add_vfsmount_mark(struct fsnotify_group *group, 1340 struct vfsmount *mnt, __u32 mask, 1341 unsigned int flags, __kernel_fsid_t *fsid) 1342 { 1343 return fanotify_add_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, 1344 FSNOTIFY_OBJ_TYPE_VFSMOUNT, mask, flags, fsid); 1345 } 1346 1347 static int fanotify_add_sb_mark(struct fsnotify_group *group, 1348 struct super_block *sb, __u32 mask, 1349 unsigned int flags, __kernel_fsid_t *fsid) 1350 { 1351 return fanotify_add_mark(group, &sb->s_fsnotify_marks, 1352 FSNOTIFY_OBJ_TYPE_SB, mask, flags, fsid); 1353 } 1354 1355 static int fanotify_add_inode_mark(struct fsnotify_group *group, 1356 struct inode *inode, __u32 mask, 1357 unsigned int flags, __kernel_fsid_t *fsid) 1358 { 1359 pr_debug("%s: group=%p inode=%p\n", __func__, group, inode); 1360 1361 /* 1362 * If some other task has this inode open for write we should not add 1363 * an ignore mask, unless that ignore mask is supposed to survive 1364 * modification changes anyway. 1365 */ 1366 if ((flags & FANOTIFY_MARK_IGNORE_BITS) && 1367 !(flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1368 inode_is_open_for_write(inode)) 1369 return 0; 1370 1371 return fanotify_add_mark(group, &inode->i_fsnotify_marks, 1372 FSNOTIFY_OBJ_TYPE_INODE, mask, flags, fsid); 1373 } 1374 1375 static struct fsnotify_event *fanotify_alloc_overflow_event(void) 1376 { 1377 struct fanotify_event *oevent; 1378 1379 oevent = kmalloc(sizeof(*oevent), GFP_KERNEL_ACCOUNT); 1380 if (!oevent) 1381 return NULL; 1382 1383 fanotify_init_event(oevent, 0, FS_Q_OVERFLOW); 1384 oevent->type = FANOTIFY_EVENT_TYPE_OVERFLOW; 1385 1386 return &oevent->fse; 1387 } 1388 1389 static struct hlist_head *fanotify_alloc_merge_hash(void) 1390 { 1391 struct hlist_head *hash; 1392 1393 hash = kmalloc(sizeof(struct hlist_head) << FANOTIFY_HTABLE_BITS, 1394 GFP_KERNEL_ACCOUNT); 1395 if (!hash) 1396 return NULL; 1397 1398 __hash_init(hash, FANOTIFY_HTABLE_SIZE); 1399 1400 return hash; 1401 } 1402 1403 /* fanotify syscalls */ 1404 SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 1405 { 1406 struct fsnotify_group *group; 1407 int f_flags, fd; 1408 unsigned int fid_mode = flags & FANOTIFY_FID_BITS; 1409 unsigned int class = flags & FANOTIFY_CLASS_BITS; 1410 unsigned int internal_flags = 0; 1411 1412 pr_debug("%s: flags=%x event_f_flags=%x\n", 1413 __func__, flags, event_f_flags); 1414 1415 if (!capable(CAP_SYS_ADMIN)) { 1416 /* 1417 * An unprivileged user can setup an fanotify group with 1418 * limited functionality - an unprivileged group is limited to 1419 * notification events with file handles and it cannot use 1420 * unlimited queue/marks. 1421 */ 1422 if ((flags & FANOTIFY_ADMIN_INIT_FLAGS) || !fid_mode) 1423 return -EPERM; 1424 1425 /* 1426 * Setting the internal flag FANOTIFY_UNPRIV on the group 1427 * prevents setting mount/filesystem marks on this group and 1428 * prevents reporting pid and open fd in events. 1429 */ 1430 internal_flags |= FANOTIFY_UNPRIV; 1431 } 1432 1433 #ifdef CONFIG_AUDITSYSCALL 1434 if (flags & ~(FANOTIFY_INIT_FLAGS | FAN_ENABLE_AUDIT)) 1435 #else 1436 if (flags & ~FANOTIFY_INIT_FLAGS) 1437 #endif 1438 return -EINVAL; 1439 1440 /* 1441 * A pidfd can only be returned for a thread-group leader; thus 1442 * FAN_REPORT_PIDFD and FAN_REPORT_TID need to remain mutually 1443 * exclusive. 1444 */ 1445 if ((flags & FAN_REPORT_PIDFD) && (flags & FAN_REPORT_TID)) 1446 return -EINVAL; 1447 1448 if (event_f_flags & ~FANOTIFY_INIT_ALL_EVENT_F_BITS) 1449 return -EINVAL; 1450 1451 switch (event_f_flags & O_ACCMODE) { 1452 case O_RDONLY: 1453 case O_RDWR: 1454 case O_WRONLY: 1455 break; 1456 default: 1457 return -EINVAL; 1458 } 1459 1460 if (fid_mode && class != FAN_CLASS_NOTIF) 1461 return -EINVAL; 1462 1463 /* 1464 * Child name is reported with parent fid so requires dir fid. 1465 * We can report both child fid and dir fid with or without name. 1466 */ 1467 if ((fid_mode & FAN_REPORT_NAME) && !(fid_mode & FAN_REPORT_DIR_FID)) 1468 return -EINVAL; 1469 1470 /* 1471 * FAN_REPORT_TARGET_FID requires FAN_REPORT_NAME and FAN_REPORT_FID 1472 * and is used as an indication to report both dir and child fid on all 1473 * dirent events. 1474 */ 1475 if ((fid_mode & FAN_REPORT_TARGET_FID) && 1476 (!(fid_mode & FAN_REPORT_NAME) || !(fid_mode & FAN_REPORT_FID))) 1477 return -EINVAL; 1478 1479 f_flags = O_RDWR | __FMODE_NONOTIFY; 1480 if (flags & FAN_CLOEXEC) 1481 f_flags |= O_CLOEXEC; 1482 if (flags & FAN_NONBLOCK) 1483 f_flags |= O_NONBLOCK; 1484 1485 /* fsnotify_alloc_group takes a ref. Dropped in fanotify_release */ 1486 group = fsnotify_alloc_group(&fanotify_fsnotify_ops, 1487 FSNOTIFY_GROUP_USER | FSNOTIFY_GROUP_NOFS); 1488 if (IS_ERR(group)) { 1489 return PTR_ERR(group); 1490 } 1491 1492 /* Enforce groups limits per user in all containing user ns */ 1493 group->fanotify_data.ucounts = inc_ucount(current_user_ns(), 1494 current_euid(), 1495 UCOUNT_FANOTIFY_GROUPS); 1496 if (!group->fanotify_data.ucounts) { 1497 fd = -EMFILE; 1498 goto out_destroy_group; 1499 } 1500 1501 group->fanotify_data.flags = flags | internal_flags; 1502 group->memcg = get_mem_cgroup_from_mm(current->mm); 1503 1504 group->fanotify_data.merge_hash = fanotify_alloc_merge_hash(); 1505 if (!group->fanotify_data.merge_hash) { 1506 fd = -ENOMEM; 1507 goto out_destroy_group; 1508 } 1509 1510 group->overflow_event = fanotify_alloc_overflow_event(); 1511 if (unlikely(!group->overflow_event)) { 1512 fd = -ENOMEM; 1513 goto out_destroy_group; 1514 } 1515 1516 if (force_o_largefile()) 1517 event_f_flags |= O_LARGEFILE; 1518 group->fanotify_data.f_flags = event_f_flags; 1519 init_waitqueue_head(&group->fanotify_data.access_waitq); 1520 INIT_LIST_HEAD(&group->fanotify_data.access_list); 1521 switch (class) { 1522 case FAN_CLASS_NOTIF: 1523 group->priority = FS_PRIO_0; 1524 break; 1525 case FAN_CLASS_CONTENT: 1526 group->priority = FS_PRIO_1; 1527 break; 1528 case FAN_CLASS_PRE_CONTENT: 1529 group->priority = FS_PRIO_2; 1530 break; 1531 default: 1532 fd = -EINVAL; 1533 goto out_destroy_group; 1534 } 1535 1536 if (flags & FAN_UNLIMITED_QUEUE) { 1537 fd = -EPERM; 1538 if (!capable(CAP_SYS_ADMIN)) 1539 goto out_destroy_group; 1540 group->max_events = UINT_MAX; 1541 } else { 1542 group->max_events = fanotify_max_queued_events; 1543 } 1544 1545 if (flags & FAN_UNLIMITED_MARKS) { 1546 fd = -EPERM; 1547 if (!capable(CAP_SYS_ADMIN)) 1548 goto out_destroy_group; 1549 } 1550 1551 if (flags & FAN_ENABLE_AUDIT) { 1552 fd = -EPERM; 1553 if (!capable(CAP_AUDIT_WRITE)) 1554 goto out_destroy_group; 1555 } 1556 1557 fd = anon_inode_getfd("[fanotify]", &fanotify_fops, group, f_flags); 1558 if (fd < 0) 1559 goto out_destroy_group; 1560 1561 return fd; 1562 1563 out_destroy_group: 1564 fsnotify_destroy_group(group); 1565 return fd; 1566 } 1567 1568 static int fanotify_test_fsid(struct dentry *dentry, __kernel_fsid_t *fsid) 1569 { 1570 __kernel_fsid_t root_fsid; 1571 int err; 1572 1573 /* 1574 * Make sure dentry is not of a filesystem with zero fsid (e.g. fuse). 1575 */ 1576 err = vfs_get_fsid(dentry, fsid); 1577 if (err) 1578 return err; 1579 1580 if (!fsid->val[0] && !fsid->val[1]) 1581 return -ENODEV; 1582 1583 /* 1584 * Make sure dentry is not of a filesystem subvolume (e.g. btrfs) 1585 * which uses a different fsid than sb root. 1586 */ 1587 err = vfs_get_fsid(dentry->d_sb->s_root, &root_fsid); 1588 if (err) 1589 return err; 1590 1591 if (root_fsid.val[0] != fsid->val[0] || 1592 root_fsid.val[1] != fsid->val[1]) 1593 return -EXDEV; 1594 1595 return 0; 1596 } 1597 1598 /* Check if filesystem can encode a unique fid */ 1599 static int fanotify_test_fid(struct dentry *dentry, unsigned int flags) 1600 { 1601 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1602 const struct export_operations *nop = dentry->d_sb->s_export_op; 1603 1604 /* 1605 * We need to make sure that the filesystem supports encoding of 1606 * file handles so user can use name_to_handle_at() to compare fids 1607 * reported with events to the file handle of watched objects. 1608 */ 1609 if (!nop) 1610 return -EOPNOTSUPP; 1611 1612 /* 1613 * For sb/mount mark, we also need to make sure that the filesystem 1614 * supports decoding file handles, so user has a way to map back the 1615 * reported fids to filesystem objects. 1616 */ 1617 if (mark_type != FAN_MARK_INODE && !nop->fh_to_dentry) 1618 return -EOPNOTSUPP; 1619 1620 return 0; 1621 } 1622 1623 static int fanotify_events_supported(struct fsnotify_group *group, 1624 const struct path *path, __u64 mask, 1625 unsigned int flags) 1626 { 1627 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1628 /* Strict validation of events in non-dir inode mask with v5.17+ APIs */ 1629 bool strict_dir_events = FAN_GROUP_FLAG(group, FAN_REPORT_TARGET_FID) || 1630 (mask & FAN_RENAME) || 1631 (flags & FAN_MARK_IGNORE); 1632 1633 /* 1634 * Some filesystems such as 'proc' acquire unusual locks when opening 1635 * files. For them fanotify permission events have high chances of 1636 * deadlocking the system - open done when reporting fanotify event 1637 * blocks on this "unusual" lock while another process holding the lock 1638 * waits for fanotify permission event to be answered. Just disallow 1639 * permission events for such filesystems. 1640 */ 1641 if (mask & FANOTIFY_PERM_EVENTS && 1642 path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) 1643 return -EINVAL; 1644 1645 /* 1646 * mount and sb marks are not allowed on kernel internal pseudo fs, 1647 * like pipe_mnt, because that would subscribe to events on all the 1648 * anonynous pipes in the system. 1649 * 1650 * SB_NOUSER covers all of the internal pseudo fs whose objects are not 1651 * exposed to user's mount namespace, but there are other SB_KERNMOUNT 1652 * fs, like nsfs, debugfs, for which the value of allowing sb and mount 1653 * mark is questionable. For now we leave them alone. 1654 */ 1655 if (mark_type != FAN_MARK_INODE && 1656 path->mnt->mnt_sb->s_flags & SB_NOUSER) 1657 return -EINVAL; 1658 1659 /* 1660 * We shouldn't have allowed setting dirent events and the directory 1661 * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode, 1662 * but because we always allowed it, error only when using new APIs. 1663 */ 1664 if (strict_dir_events && mark_type == FAN_MARK_INODE && 1665 !d_is_dir(path->dentry) && (mask & FANOTIFY_DIRONLY_EVENT_BITS)) 1666 return -ENOTDIR; 1667 1668 return 0; 1669 } 1670 1671 static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, 1672 int dfd, const char __user *pathname) 1673 { 1674 struct inode *inode = NULL; 1675 struct vfsmount *mnt = NULL; 1676 struct fsnotify_group *group; 1677 struct fd f; 1678 struct path path; 1679 __kernel_fsid_t __fsid, *fsid = NULL; 1680 u32 valid_mask = FANOTIFY_EVENTS | FANOTIFY_EVENT_FLAGS; 1681 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1682 unsigned int mark_cmd = flags & FANOTIFY_MARK_CMD_BITS; 1683 unsigned int ignore = flags & FANOTIFY_MARK_IGNORE_BITS; 1684 unsigned int obj_type, fid_mode; 1685 u32 umask = 0; 1686 int ret; 1687 1688 pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n", 1689 __func__, fanotify_fd, flags, dfd, pathname, mask); 1690 1691 /* we only use the lower 32 bits as of right now. */ 1692 if (upper_32_bits(mask)) 1693 return -EINVAL; 1694 1695 if (flags & ~FANOTIFY_MARK_FLAGS) 1696 return -EINVAL; 1697 1698 switch (mark_type) { 1699 case FAN_MARK_INODE: 1700 obj_type = FSNOTIFY_OBJ_TYPE_INODE; 1701 break; 1702 case FAN_MARK_MOUNT: 1703 obj_type = FSNOTIFY_OBJ_TYPE_VFSMOUNT; 1704 break; 1705 case FAN_MARK_FILESYSTEM: 1706 obj_type = FSNOTIFY_OBJ_TYPE_SB; 1707 break; 1708 default: 1709 return -EINVAL; 1710 } 1711 1712 switch (mark_cmd) { 1713 case FAN_MARK_ADD: 1714 case FAN_MARK_REMOVE: 1715 if (!mask) 1716 return -EINVAL; 1717 break; 1718 case FAN_MARK_FLUSH: 1719 if (flags & ~(FANOTIFY_MARK_TYPE_BITS | FAN_MARK_FLUSH)) 1720 return -EINVAL; 1721 break; 1722 default: 1723 return -EINVAL; 1724 } 1725 1726 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 1727 valid_mask |= FANOTIFY_PERM_EVENTS; 1728 1729 if (mask & ~valid_mask) 1730 return -EINVAL; 1731 1732 1733 /* We don't allow FAN_MARK_IGNORE & FAN_MARK_IGNORED_MASK together */ 1734 if (ignore == (FAN_MARK_IGNORE | FAN_MARK_IGNORED_MASK)) 1735 return -EINVAL; 1736 1737 /* 1738 * Event flags (FAN_ONDIR, FAN_EVENT_ON_CHILD) have no effect with 1739 * FAN_MARK_IGNORED_MASK. 1740 */ 1741 if (ignore == FAN_MARK_IGNORED_MASK) { 1742 mask &= ~FANOTIFY_EVENT_FLAGS; 1743 umask = FANOTIFY_EVENT_FLAGS; 1744 } 1745 1746 f = fdget(fanotify_fd); 1747 if (unlikely(!f.file)) 1748 return -EBADF; 1749 1750 /* verify that this is indeed an fanotify instance */ 1751 ret = -EINVAL; 1752 if (unlikely(f.file->f_op != &fanotify_fops)) 1753 goto fput_and_out; 1754 group = f.file->private_data; 1755 1756 /* 1757 * An unprivileged user is not allowed to setup mount nor filesystem 1758 * marks. This also includes setting up such marks by a group that 1759 * was initialized by an unprivileged user. 1760 */ 1761 ret = -EPERM; 1762 if ((!capable(CAP_SYS_ADMIN) || 1763 FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV)) && 1764 mark_type != FAN_MARK_INODE) 1765 goto fput_and_out; 1766 1767 /* 1768 * group->priority == FS_PRIO_0 == FAN_CLASS_NOTIF. These are not 1769 * allowed to set permissions events. 1770 */ 1771 ret = -EINVAL; 1772 if (mask & FANOTIFY_PERM_EVENTS && 1773 group->priority == FS_PRIO_0) 1774 goto fput_and_out; 1775 1776 if (mask & FAN_FS_ERROR && 1777 mark_type != FAN_MARK_FILESYSTEM) 1778 goto fput_and_out; 1779 1780 /* 1781 * Evictable is only relevant for inode marks, because only inode object 1782 * can be evicted on memory pressure. 1783 */ 1784 if (flags & FAN_MARK_EVICTABLE && 1785 mark_type != FAN_MARK_INODE) 1786 goto fput_and_out; 1787 1788 /* 1789 * Events that do not carry enough information to report 1790 * event->fd require a group that supports reporting fid. Those 1791 * events are not supported on a mount mark, because they do not 1792 * carry enough information (i.e. path) to be filtered by mount 1793 * point. 1794 */ 1795 fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); 1796 if (mask & ~(FANOTIFY_FD_EVENTS|FANOTIFY_EVENT_FLAGS) && 1797 (!fid_mode || mark_type == FAN_MARK_MOUNT)) 1798 goto fput_and_out; 1799 1800 /* 1801 * FAN_RENAME uses special info type records to report the old and 1802 * new parent+name. Reporting only old and new parent id is less 1803 * useful and was not implemented. 1804 */ 1805 if (mask & FAN_RENAME && !(fid_mode & FAN_REPORT_NAME)) 1806 goto fput_and_out; 1807 1808 if (mark_cmd == FAN_MARK_FLUSH) { 1809 ret = 0; 1810 if (mark_type == FAN_MARK_MOUNT) 1811 fsnotify_clear_vfsmount_marks_by_group(group); 1812 else if (mark_type == FAN_MARK_FILESYSTEM) 1813 fsnotify_clear_sb_marks_by_group(group); 1814 else 1815 fsnotify_clear_inode_marks_by_group(group); 1816 goto fput_and_out; 1817 } 1818 1819 ret = fanotify_find_path(dfd, pathname, &path, flags, 1820 (mask & ALL_FSNOTIFY_EVENTS), obj_type); 1821 if (ret) 1822 goto fput_and_out; 1823 1824 if (mark_cmd == FAN_MARK_ADD) { 1825 ret = fanotify_events_supported(group, &path, mask, flags); 1826 if (ret) 1827 goto path_put_and_out; 1828 } 1829 1830 if (fid_mode) { 1831 ret = fanotify_test_fsid(path.dentry, &__fsid); 1832 if (ret) 1833 goto path_put_and_out; 1834 1835 ret = fanotify_test_fid(path.dentry, flags); 1836 if (ret) 1837 goto path_put_and_out; 1838 1839 fsid = &__fsid; 1840 } 1841 1842 /* inode held in place by reference to path; group by fget on fd */ 1843 if (mark_type == FAN_MARK_INODE) 1844 inode = path.dentry->d_inode; 1845 else 1846 mnt = path.mnt; 1847 1848 ret = mnt ? -EINVAL : -EISDIR; 1849 /* FAN_MARK_IGNORE requires SURV_MODIFY for sb/mount/dir marks */ 1850 if (mark_cmd == FAN_MARK_ADD && ignore == FAN_MARK_IGNORE && 1851 (mnt || S_ISDIR(inode->i_mode)) && 1852 !(flags & FAN_MARK_IGNORED_SURV_MODIFY)) 1853 goto path_put_and_out; 1854 1855 /* Mask out FAN_EVENT_ON_CHILD flag for sb/mount/non-dir marks */ 1856 if (mnt || !S_ISDIR(inode->i_mode)) { 1857 mask &= ~FAN_EVENT_ON_CHILD; 1858 umask = FAN_EVENT_ON_CHILD; 1859 /* 1860 * If group needs to report parent fid, register for getting 1861 * events with parent/name info for non-directory. 1862 */ 1863 if ((fid_mode & FAN_REPORT_DIR_FID) && 1864 (flags & FAN_MARK_ADD) && !ignore) 1865 mask |= FAN_EVENT_ON_CHILD; 1866 } 1867 1868 /* create/update an inode mark */ 1869 switch (mark_cmd) { 1870 case FAN_MARK_ADD: 1871 if (mark_type == FAN_MARK_MOUNT) 1872 ret = fanotify_add_vfsmount_mark(group, mnt, mask, 1873 flags, fsid); 1874 else if (mark_type == FAN_MARK_FILESYSTEM) 1875 ret = fanotify_add_sb_mark(group, mnt->mnt_sb, mask, 1876 flags, fsid); 1877 else 1878 ret = fanotify_add_inode_mark(group, inode, mask, 1879 flags, fsid); 1880 break; 1881 case FAN_MARK_REMOVE: 1882 if (mark_type == FAN_MARK_MOUNT) 1883 ret = fanotify_remove_vfsmount_mark(group, mnt, mask, 1884 flags, umask); 1885 else if (mark_type == FAN_MARK_FILESYSTEM) 1886 ret = fanotify_remove_sb_mark(group, mnt->mnt_sb, mask, 1887 flags, umask); 1888 else 1889 ret = fanotify_remove_inode_mark(group, inode, mask, 1890 flags, umask); 1891 break; 1892 default: 1893 ret = -EINVAL; 1894 } 1895 1896 path_put_and_out: 1897 path_put(&path); 1898 fput_and_out: 1899 fdput(f); 1900 return ret; 1901 } 1902 1903 #ifndef CONFIG_ARCH_SPLIT_ARG64 1904 SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, 1905 __u64, mask, int, dfd, 1906 const char __user *, pathname) 1907 { 1908 return do_fanotify_mark(fanotify_fd, flags, mask, dfd, pathname); 1909 } 1910 #endif 1911 1912 #if defined(CONFIG_ARCH_SPLIT_ARG64) || defined(CONFIG_COMPAT) 1913 SYSCALL32_DEFINE6(fanotify_mark, 1914 int, fanotify_fd, unsigned int, flags, 1915 SC_ARG64(mask), int, dfd, 1916 const char __user *, pathname) 1917 { 1918 return do_fanotify_mark(fanotify_fd, flags, SC_VAL64(__u64, mask), 1919 dfd, pathname); 1920 } 1921 #endif 1922 1923 /* 1924 * fanotify_user_setup - Our initialization function. Note that we cannot return 1925 * error because we have compiled-in VFS hooks. So an (unlikely) failure here 1926 * must result in panic(). 1927 */ 1928 static int __init fanotify_user_setup(void) 1929 { 1930 struct sysinfo si; 1931 int max_marks; 1932 1933 si_meminfo(&si); 1934 /* 1935 * Allow up to 1% of addressable memory to be accounted for per user 1936 * marks limited to the range [8192, 1048576]. mount and sb marks are 1937 * a lot cheaper than inode marks, but there is no reason for a user 1938 * to have many of those, so calculate by the cost of inode marks. 1939 */ 1940 max_marks = (((si.totalram - si.totalhigh) / 100) << PAGE_SHIFT) / 1941 INODE_MARK_COST; 1942 max_marks = clamp(max_marks, FANOTIFY_OLD_DEFAULT_MAX_MARKS, 1943 FANOTIFY_DEFAULT_MAX_USER_MARKS); 1944 1945 BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS); 1946 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 13); 1947 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 11); 1948 1949 fanotify_mark_cache = KMEM_CACHE(fsnotify_mark, 1950 SLAB_PANIC|SLAB_ACCOUNT); 1951 fanotify_fid_event_cachep = KMEM_CACHE(fanotify_fid_event, 1952 SLAB_PANIC); 1953 fanotify_path_event_cachep = KMEM_CACHE(fanotify_path_event, 1954 SLAB_PANIC); 1955 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) { 1956 fanotify_perm_event_cachep = 1957 KMEM_CACHE(fanotify_perm_event, SLAB_PANIC); 1958 } 1959 1960 fanotify_max_queued_events = FANOTIFY_DEFAULT_MAX_EVENTS; 1961 init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS] = 1962 FANOTIFY_DEFAULT_MAX_GROUPS; 1963 init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS] = max_marks; 1964 fanotify_sysctls_init(); 1965 1966 return 0; 1967 } 1968 device_initcall(fanotify_user_setup); 1969