1 | /* SPDX-License-Identifier: GPL-2.0 */ |
2 | #ifndef _LINUX_FANOTIFY_H |
3 | #define _LINUX_FANOTIFY_H |
4 | |
5 | #include <linux/sysctl.h> |
6 | #include <uapi/linux/fanotify.h> |
7 | |
8 | #define FAN_GROUP_FLAG(group, flag) \ |
9 | ((group)->fanotify_data.flags & (flag)) |
10 | |
11 | /* |
12 | * Flags allowed to be passed from/to userspace. |
13 | * |
14 | * We intentionally do not add new bits to the old FAN_ALL_* constants, because |
15 | * they are uapi exposed constants. If there are programs out there using |
16 | * these constant, the programs may break if re-compiled with new uapi headers |
17 | * and then run on an old kernel. |
18 | */ |
19 | |
20 | /* Group classes where permission events are allowed */ |
21 | #define FANOTIFY_PERM_CLASSES (FAN_CLASS_CONTENT | \ |
22 | FAN_CLASS_PRE_CONTENT) |
23 | |
24 | #define FANOTIFY_CLASS_BITS (FAN_CLASS_NOTIF | FANOTIFY_PERM_CLASSES) |
25 | |
26 | #define FANOTIFY_FID_BITS (FAN_REPORT_DFID_NAME_TARGET) |
27 | |
28 | #define FANOTIFY_INFO_MODES (FANOTIFY_FID_BITS | FAN_REPORT_PIDFD) |
29 | |
30 | /* |
31 | * fanotify_init() flags that require CAP_SYS_ADMIN. |
32 | * We do not allow unprivileged groups to request permission events. |
33 | * We do not allow unprivileged groups to get other process pid in events. |
34 | * We do not allow unprivileged groups to use unlimited resources. |
35 | */ |
36 | #define FANOTIFY_ADMIN_INIT_FLAGS (FANOTIFY_PERM_CLASSES | \ |
37 | FAN_REPORT_TID | \ |
38 | FAN_REPORT_PIDFD | \ |
39 | FAN_UNLIMITED_QUEUE | \ |
40 | FAN_UNLIMITED_MARKS) |
41 | |
42 | /* |
43 | * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN. |
44 | * FAN_CLASS_NOTIF is the only class we allow for unprivileged group. |
45 | * We do not allow unprivileged groups to get file descriptors in events, |
46 | * so one of the flags for reporting file handles is required. |
47 | */ |
48 | #define FANOTIFY_USER_INIT_FLAGS (FAN_CLASS_NOTIF | \ |
49 | FANOTIFY_FID_BITS | \ |
50 | FAN_CLOEXEC | FAN_NONBLOCK) |
51 | |
52 | #define FANOTIFY_INIT_FLAGS (FANOTIFY_ADMIN_INIT_FLAGS | \ |
53 | FANOTIFY_USER_INIT_FLAGS) |
54 | |
55 | /* Internal group flags */ |
56 | #define FANOTIFY_UNPRIV 0x80000000 |
57 | #define FANOTIFY_INTERNAL_GROUP_FLAGS (FANOTIFY_UNPRIV) |
58 | |
59 | #define FANOTIFY_MARK_TYPE_BITS (FAN_MARK_INODE | FAN_MARK_MOUNT | \ |
60 | FAN_MARK_FILESYSTEM) |
61 | |
62 | #define FANOTIFY_MARK_CMD_BITS (FAN_MARK_ADD | FAN_MARK_REMOVE | \ |
63 | FAN_MARK_FLUSH) |
64 | |
65 | #define FANOTIFY_MARK_IGNORE_BITS (FAN_MARK_IGNORED_MASK | \ |
66 | FAN_MARK_IGNORE) |
67 | |
68 | #define FANOTIFY_MARK_FLAGS (FANOTIFY_MARK_TYPE_BITS | \ |
69 | FANOTIFY_MARK_CMD_BITS | \ |
70 | FANOTIFY_MARK_IGNORE_BITS | \ |
71 | FAN_MARK_DONT_FOLLOW | \ |
72 | FAN_MARK_ONLYDIR | \ |
73 | FAN_MARK_IGNORED_SURV_MODIFY | \ |
74 | FAN_MARK_EVICTABLE) |
75 | |
76 | /* |
77 | * Events that can be reported with data type FSNOTIFY_EVENT_PATH. |
78 | * Note that FAN_MODIFY can also be reported with data type |
79 | * FSNOTIFY_EVENT_INODE. |
80 | */ |
81 | #define FANOTIFY_PATH_EVENTS (FAN_ACCESS | FAN_MODIFY | \ |
82 | FAN_CLOSE | FAN_OPEN | FAN_OPEN_EXEC) |
83 | |
84 | /* |
85 | * Directory entry modification events - reported only to directory |
86 | * where entry is modified and not to a watching parent. |
87 | */ |
88 | #define FANOTIFY_DIRENT_EVENTS (FAN_MOVE | FAN_CREATE | FAN_DELETE | \ |
89 | FAN_RENAME) |
90 | |
91 | /* Events that can be reported with event->fd */ |
92 | #define FANOTIFY_FD_EVENTS (FANOTIFY_PATH_EVENTS | FANOTIFY_PERM_EVENTS) |
93 | |
94 | /* Events that can only be reported with data type FSNOTIFY_EVENT_INODE */ |
95 | #define FANOTIFY_INODE_EVENTS (FANOTIFY_DIRENT_EVENTS | \ |
96 | FAN_ATTRIB | FAN_MOVE_SELF | FAN_DELETE_SELF) |
97 | |
98 | /* Events that can only be reported with data type FSNOTIFY_EVENT_ERROR */ |
99 | #define FANOTIFY_ERROR_EVENTS (FAN_FS_ERROR) |
100 | |
101 | /* Events that user can request to be notified on */ |
102 | #define FANOTIFY_EVENTS (FANOTIFY_PATH_EVENTS | \ |
103 | FANOTIFY_INODE_EVENTS | \ |
104 | FANOTIFY_ERROR_EVENTS) |
105 | |
106 | /* Events that require a permission response from user */ |
107 | #define FANOTIFY_PERM_EVENTS (FAN_OPEN_PERM | FAN_ACCESS_PERM | \ |
108 | FAN_OPEN_EXEC_PERM) |
109 | |
110 | /* Extra flags that may be reported with event or control handling of events */ |
111 | #define FANOTIFY_EVENT_FLAGS (FAN_EVENT_ON_CHILD | FAN_ONDIR) |
112 | |
113 | /* Events that may be reported to user */ |
114 | #define FANOTIFY_OUTGOING_EVENTS (FANOTIFY_EVENTS | \ |
115 | FANOTIFY_PERM_EVENTS | \ |
116 | FAN_Q_OVERFLOW | FAN_ONDIR) |
117 | |
118 | /* Events and flags relevant only for directories */ |
119 | #define FANOTIFY_DIRONLY_EVENT_BITS (FANOTIFY_DIRENT_EVENTS | \ |
120 | FAN_EVENT_ON_CHILD | FAN_ONDIR) |
121 | |
122 | #define ALL_FANOTIFY_EVENT_BITS (FANOTIFY_OUTGOING_EVENTS | \ |
123 | FANOTIFY_EVENT_FLAGS) |
124 | |
125 | /* These masks check for invalid bits in permission responses. */ |
126 | #define FANOTIFY_RESPONSE_ACCESS (FAN_ALLOW | FAN_DENY) |
127 | #define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO) |
128 | #define FANOTIFY_RESPONSE_VALID_MASK (FANOTIFY_RESPONSE_ACCESS | FANOTIFY_RESPONSE_FLAGS) |
129 | |
130 | /* Do not use these old uapi constants internally */ |
131 | #undef FAN_ALL_CLASS_BITS |
132 | #undef FAN_ALL_INIT_FLAGS |
133 | #undef FAN_ALL_MARK_FLAGS |
134 | #undef FAN_ALL_EVENTS |
135 | #undef FAN_ALL_PERM_EVENTS |
136 | #undef FAN_ALL_OUTGOING_EVENTS |
137 | |
138 | #endif /* _LINUX_FANOTIFY_H */ |
139 | |