1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_FANOTIFY_H
3 #define _LINUX_FANOTIFY_H
4 
5 #include <linux/sysctl.h>
6 #include <uapi/linux/fanotify.h>
7 
8 #define FAN_GROUP_FLAG(group, flag) \
9 	((group)->fanotify_data.flags & (flag))
10 
11 /*
12  * Flags allowed to be passed from/to userspace.
13  *
14  * We intentionally do not add new bits to the old FAN_ALL_* constants, because
15  * they are uapi exposed constants. If there are programs out there using
16  * these constant, the programs may break if re-compiled with new uapi headers
17  * and then run on an old kernel.
18  */
19 
20 /* Group classes where permission events are allowed */
21 #define FANOTIFY_PERM_CLASSES	(FAN_CLASS_CONTENT | \
22 				 FAN_CLASS_PRE_CONTENT)
23 
24 #define FANOTIFY_CLASS_BITS	(FAN_CLASS_NOTIF | FANOTIFY_PERM_CLASSES)
25 
26 #define FANOTIFY_FID_BITS	(FAN_REPORT_DFID_NAME_TARGET)
27 
28 #define FANOTIFY_INFO_MODES	(FANOTIFY_FID_BITS | FAN_REPORT_PIDFD | FAN_REPORT_MNT)
29 
30 /*
31  * fanotify_init() flags that require CAP_SYS_ADMIN.
32  * We do not allow unprivileged groups to request permission events.
33  * We do not allow unprivileged groups to get other process pid in events.
34  * We do not allow unprivileged groups to use unlimited resources.
35  */
36 #define FANOTIFY_ADMIN_INIT_FLAGS	(FANOTIFY_PERM_CLASSES | \
37 					 FAN_REPORT_TID | \
38 					 FAN_REPORT_PIDFD | \
39 					 FAN_REPORT_FD_ERROR | \
40 					 FAN_UNLIMITED_QUEUE | \
41 					 FAN_UNLIMITED_MARKS | \
42 					 FAN_REPORT_MNT)
43 
44 /*
45  * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN.
46  * FAN_CLASS_NOTIF is the only class we allow for unprivileged group.
47  * We do not allow unprivileged groups to get file descriptors in events,
48  * so one of the flags for reporting file handles is required.
49  */
50 #define FANOTIFY_USER_INIT_FLAGS	(FAN_CLASS_NOTIF | \
51 					 FANOTIFY_FID_BITS | \
52 					 FAN_CLOEXEC | FAN_NONBLOCK)
53 
54 #define FANOTIFY_INIT_FLAGS	(FANOTIFY_ADMIN_INIT_FLAGS | \
55 				 FANOTIFY_USER_INIT_FLAGS)
56 
57 /* Internal group flags */
58 #define FANOTIFY_UNPRIV		0x80000000
59 #define FANOTIFY_INTERNAL_GROUP_FLAGS	(FANOTIFY_UNPRIV)
60 
61 #define FANOTIFY_MARK_TYPE_BITS	(FAN_MARK_INODE | FAN_MARK_MOUNT | \
62 				 FAN_MARK_FILESYSTEM | FAN_MARK_MNTNS)
63 
64 #define FANOTIFY_MARK_CMD_BITS	(FAN_MARK_ADD | FAN_MARK_REMOVE | \
65 				 FAN_MARK_FLUSH)
66 
67 #define FANOTIFY_MARK_IGNORE_BITS (FAN_MARK_IGNORED_MASK | \
68 				   FAN_MARK_IGNORE)
69 
70 #define FANOTIFY_MARK_FLAGS	(FANOTIFY_MARK_TYPE_BITS | \
71 				 FANOTIFY_MARK_CMD_BITS | \
72 				 FANOTIFY_MARK_IGNORE_BITS | \
73 				 FAN_MARK_DONT_FOLLOW | \
74 				 FAN_MARK_ONLYDIR | \
75 				 FAN_MARK_IGNORED_SURV_MODIFY | \
76 				 FAN_MARK_EVICTABLE)
77 
78 /*
79  * Events that can be reported with data type FSNOTIFY_EVENT_PATH.
80  * Note that FAN_MODIFY can also be reported with data type
81  * FSNOTIFY_EVENT_INODE.
82  */
83 #define FANOTIFY_PATH_EVENTS	(FAN_ACCESS | FAN_MODIFY | \
84 				 FAN_CLOSE | FAN_OPEN | FAN_OPEN_EXEC)
85 
86 /*
87  * Directory entry modification events - reported only to directory
88  * where entry is modified and not to a watching parent.
89  */
90 #define FANOTIFY_DIRENT_EVENTS	(FAN_MOVE | FAN_CREATE | FAN_DELETE | \
91 				 FAN_RENAME)
92 
93 /* Content events can be used to inspect file content */
94 #define FANOTIFY_CONTENT_PERM_EVENTS (FAN_OPEN_PERM | FAN_OPEN_EXEC_PERM | \
95 				      FAN_ACCESS_PERM)
96 /* Pre-content events can be used to fill file content */
97 #define FANOTIFY_PRE_CONTENT_EVENTS  (FAN_PRE_ACCESS)
98 
99 /* Events that require a permission response from user */
100 #define FANOTIFY_PERM_EVENTS	(FANOTIFY_CONTENT_PERM_EVENTS | \
101 				 FANOTIFY_PRE_CONTENT_EVENTS)
102 
103 /* Events that can be reported with event->fd */
104 #define FANOTIFY_FD_EVENTS (FANOTIFY_PATH_EVENTS | FANOTIFY_PERM_EVENTS)
105 
106 /* Events that can only be reported with data type FSNOTIFY_EVENT_INODE */
107 #define FANOTIFY_INODE_EVENTS	(FANOTIFY_DIRENT_EVENTS | \
108 				 FAN_ATTRIB | FAN_MOVE_SELF | FAN_DELETE_SELF)
109 
110 /* Events that can only be reported with data type FSNOTIFY_EVENT_ERROR */
111 #define FANOTIFY_ERROR_EVENTS	(FAN_FS_ERROR)
112 
113 #define FANOTIFY_MOUNT_EVENTS	(FAN_MNT_ATTACH | FAN_MNT_DETACH)
114 
115 /* Events that user can request to be notified on */
116 #define FANOTIFY_EVENTS		(FANOTIFY_PATH_EVENTS | \
117 				 FANOTIFY_INODE_EVENTS | \
118 				 FANOTIFY_ERROR_EVENTS | \
119 				 FANOTIFY_MOUNT_EVENTS)
120 
121 /* Extra flags that may be reported with event or control handling of events */
122 #define FANOTIFY_EVENT_FLAGS	(FAN_EVENT_ON_CHILD | FAN_ONDIR)
123 
124 /* Events that may be reported to user */
125 #define FANOTIFY_OUTGOING_EVENTS	(FANOTIFY_EVENTS | \
126 					 FANOTIFY_PERM_EVENTS | \
127 					 FAN_Q_OVERFLOW | FAN_ONDIR)
128 
129 /* Events and flags relevant only for directories */
130 #define FANOTIFY_DIRONLY_EVENT_BITS	(FANOTIFY_DIRENT_EVENTS | \
131 					 FAN_EVENT_ON_CHILD | FAN_ONDIR)
132 
133 #define ALL_FANOTIFY_EVENT_BITS		(FANOTIFY_OUTGOING_EVENTS | \
134 					 FANOTIFY_EVENT_FLAGS)
135 
136 /* These masks check for invalid bits in permission responses. */
137 #define FANOTIFY_RESPONSE_ACCESS (FAN_ALLOW | FAN_DENY)
138 #define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO)
139 #define FANOTIFY_RESPONSE_VALID_MASK \
140 	(FANOTIFY_RESPONSE_ACCESS | FANOTIFY_RESPONSE_FLAGS | \
141 	 (FAN_ERRNO_MASK << FAN_ERRNO_SHIFT))
142 
143 /* Do not use these old uapi constants internally */
144 #undef FAN_ALL_CLASS_BITS
145 #undef FAN_ALL_INIT_FLAGS
146 #undef FAN_ALL_MARK_FLAGS
147 #undef FAN_ALL_EVENTS
148 #undef FAN_ALL_PERM_EVENTS
149 #undef FAN_ALL_OUTGOING_EVENTS
150 
151 #endif /* _LINUX_FANOTIFY_H */
152