include/linux/fanotify.h

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2 #ifndef _LINUX_FANOTIFY_H
   3 #define _LINUX_FANOTIFY_H
   4
   5 #include <linux/sysctl.h>
   6 #include <uapi/linux/fanotify.h>
   7
   8 #define FAN_GROUP_FLAG(group, flag) \
   9         ((group)->fanotify_data.flags & (flag))
  10
  11 /*
  12  * Flags allowed to be passed from/to userspace.
  13  *
  14  * We intentionally do not add new bits to the old FAN_ALL_* constants, because
  15  * they are uapi exposed constants. If there are programs out there using
  16  * these constant, the programs may break if re-compiled with new uapi headers
  17  * and then run on an old kernel.
  18  */
  19
  20 /* Group classes where permission events are allowed */
  21 #define FANOTIFY_PERM_CLASSES   (FAN_CLASS_CONTENT | \
  22                                  FAN_CLASS_PRE_CONTENT)
  23
  24 #define FANOTIFY_CLASS_BITS     (FAN_CLASS_NOTIF | FANOTIFY_PERM_CLASSES)
  25
  26 #define FANOTIFY_FID_BITS       (FAN_REPORT_DFID_NAME_TARGET)
  27
  28 #define FANOTIFY_INFO_MODES     (FANOTIFY_FID_BITS | FAN_REPORT_PIDFD)
  29
  30 /*
  31  * fanotify_init() flags that require CAP_SYS_ADMIN.
  32  * We do not allow unprivileged groups to request permission events.
  33  * We do not allow unprivileged groups to get other process pid in events.
  34  * We do not allow unprivileged groups to use unlimited resources.
  35  */
  36 #define FANOTIFY_ADMIN_INIT_FLAGS       (FANOTIFY_PERM_CLASSES | \
  37                                          FAN_REPORT_TID | \
  38                                          FAN_REPORT_PIDFD | \
  39                                          FAN_REPORT_FD_ERROR | \
  40                                          FAN_UNLIMITED_QUEUE | \
  41                                          FAN_UNLIMITED_MARKS)
  42
  43 /*
  44  * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN.
  45  * FAN_CLASS_NOTIF is the only class we allow for unprivileged group.
  46  * We do not allow unprivileged groups to get file descriptors in events,
  47  * so one of the flags for reporting file handles is required.
  48  */
  49 #define FANOTIFY_USER_INIT_FLAGS        (FAN_CLASS_NOTIF | \
  50                                          FANOTIFY_FID_BITS | \
  51                                          FAN_CLOEXEC | FAN_NONBLOCK)
  52
  53 #define FANOTIFY_INIT_FLAGS     (FANOTIFY_ADMIN_INIT_FLAGS | \
  54                                  FANOTIFY_USER_INIT_FLAGS)
  55
  56 /* Internal group flags */
  57 #define FANOTIFY_UNPRIV         0x80000000
  58 #define FANOTIFY_INTERNAL_GROUP_FLAGS   (FANOTIFY_UNPRIV)
  59
  60 #define FANOTIFY_MARK_TYPE_BITS (FAN_MARK_INODE | FAN_MARK_MOUNT | \
  61                                  FAN_MARK_FILESYSTEM)
  62
  63 #define FANOTIFY_MARK_CMD_BITS  (FAN_MARK_ADD | FAN_MARK_REMOVE | \
  64                                  FAN_MARK_FLUSH)
  65
  66 #define FANOTIFY_MARK_IGNORE_BITS (FAN_MARK_IGNORED_MASK | \
  67                                    FAN_MARK_IGNORE)
  68
  69 #define FANOTIFY_MARK_FLAGS     (FANOTIFY_MARK_TYPE_BITS | \
  70                                  FANOTIFY_MARK_CMD_BITS | \
  71                                  FANOTIFY_MARK_IGNORE_BITS | \
  72                                  FAN_MARK_DONT_FOLLOW | \
  73                                  FAN_MARK_ONLYDIR | \
  74                                  FAN_MARK_IGNORED_SURV_MODIFY | \
  75                                  FAN_MARK_EVICTABLE)
  76
  77 /*
  78  * Events that can be reported with data type FSNOTIFY_EVENT_PATH.
  79  * Note that FAN_MODIFY can also be reported with data type
  80  * FSNOTIFY_EVENT_INODE.
  81  */
  82 #define FANOTIFY_PATH_EVENTS    (FAN_ACCESS | FAN_MODIFY | \
  83                                  FAN_CLOSE | FAN_OPEN | FAN_OPEN_EXEC)
  84
  85 /*
  86  * Directory entry modification events - reported only to directory
  87  * where entry is modified and not to a watching parent.
  88  */
  89 #define FANOTIFY_DIRENT_EVENTS  (FAN_MOVE | FAN_CREATE | FAN_DELETE | \
  90                                  FAN_RENAME)
  91
  92 /* Events that can be reported with event->fd */
  93 #define FANOTIFY_FD_EVENTS (FANOTIFY_PATH_EVENTS | FANOTIFY_PERM_EVENTS)
  94
  95 /* Events that can only be reported with data type FSNOTIFY_EVENT_INODE */
  96 #define FANOTIFY_INODE_EVENTS   (FANOTIFY_DIRENT_EVENTS | \
  97                                  FAN_ATTRIB | FAN_MOVE_SELF | FAN_DELETE_SELF)
  98
  99 /* Events that can only be reported with data type FSNOTIFY_EVENT_ERROR */
 100 #define FANOTIFY_ERROR_EVENTS   (FAN_FS_ERROR)
 101
 102 /* Events that user can request to be notified on */
 103 #define FANOTIFY_EVENTS         (FANOTIFY_PATH_EVENTS | \
 104                                  FANOTIFY_INODE_EVENTS | \
 105                                  FANOTIFY_ERROR_EVENTS)
 106
 107 /* Events that require a permission response from user */
 108 #define FANOTIFY_PERM_EVENTS    (FAN_OPEN_PERM | FAN_ACCESS_PERM | \
 109                                  FAN_OPEN_EXEC_PERM)
 110
 111 /* Extra flags that may be reported with event or control handling of events */
 112 #define FANOTIFY_EVENT_FLAGS    (FAN_EVENT_ON_CHILD | FAN_ONDIR)
 113
 114 /* Events that may be reported to user */
 115 #define FANOTIFY_OUTGOING_EVENTS        (FANOTIFY_EVENTS | \
 116                                          FANOTIFY_PERM_EVENTS | \
 117                                          FAN_Q_OVERFLOW | FAN_ONDIR)
 118
 119 /* Events and flags relevant only for directories */
 120 #define FANOTIFY_DIRONLY_EVENT_BITS     (FANOTIFY_DIRENT_EVENTS | \
 121                                          FAN_EVENT_ON_CHILD | FAN_ONDIR)
 122
 123 #define ALL_FANOTIFY_EVENT_BITS         (FANOTIFY_OUTGOING_EVENTS | \
 124                                          FANOTIFY_EVENT_FLAGS)
 125
 126 /* These masks check for invalid bits in permission responses. */
 127 #define FANOTIFY_RESPONSE_ACCESS (FAN_ALLOW | FAN_DENY)
 128 #define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO)
 129 #define FANOTIFY_RESPONSE_VALID_MASK (FANOTIFY_RESPONSE_ACCESS | FANOTIFY_RESPONSE_FLAGS)
 130
 131 /* Do not use these old uapi constants internally */
 132 #undef FAN_ALL_CLASS_BITS
 133 #undef FAN_ALL_INIT_FLAGS
 134 #undef FAN_ALL_MARK_FLAGS
 135 #undef FAN_ALL_EVENTS
 136 #undef FAN_ALL_PERM_EVENTS
 137 #undef FAN_ALL_OUTGOING_EVENTS
 138
 139 #endif /* _LINUX_FANOTIFY_H */