1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _LINUX_FANOTIFY_H
3#define _LINUX_FANOTIFY_H
4
5#include <linux/sysctl.h>
6#include <uapi/linux/fanotify.h>
7
8#define FAN_GROUP_FLAG(group, flag) \
9	((group)->fanotify_data.flags & (flag))
10
11/*
12 * Flags allowed to be passed from/to userspace.
13 *
14 * We intentionally do not add new bits to the old FAN_ALL_* constants, because
15 * they are uapi exposed constants. If there are programs out there using
16 * these constant, the programs may break if re-compiled with new uapi headers
17 * and then run on an old kernel.
18 */
19
20/* Group classes where permission events are allowed */
21#define FANOTIFY_PERM_CLASSES	(FAN_CLASS_CONTENT | \
22				 FAN_CLASS_PRE_CONTENT)
23
24#define FANOTIFY_CLASS_BITS	(FAN_CLASS_NOTIF | FANOTIFY_PERM_CLASSES)
25
26#define FANOTIFY_FID_BITS	(FAN_REPORT_DFID_NAME_TARGET)
27
28#define FANOTIFY_INFO_MODES	(FANOTIFY_FID_BITS | FAN_REPORT_PIDFD)
29
30/*
31 * fanotify_init() flags that require CAP_SYS_ADMIN.
32 * We do not allow unprivileged groups to request permission events.
33 * We do not allow unprivileged groups to get other process pid in events.
34 * We do not allow unprivileged groups to use unlimited resources.
35 */
36#define FANOTIFY_ADMIN_INIT_FLAGS	(FANOTIFY_PERM_CLASSES | \
37					 FAN_REPORT_TID | \
38					 FAN_REPORT_PIDFD | \
39					 FAN_UNLIMITED_QUEUE | \
40					 FAN_UNLIMITED_MARKS)
41
42/*
43 * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN.
44 * FAN_CLASS_NOTIF is the only class we allow for unprivileged group.
45 * We do not allow unprivileged groups to get file descriptors in events,
46 * so one of the flags for reporting file handles is required.
47 */
48#define FANOTIFY_USER_INIT_FLAGS	(FAN_CLASS_NOTIF | \
49					 FANOTIFY_FID_BITS | \
50					 FAN_CLOEXEC | FAN_NONBLOCK)
51
52#define FANOTIFY_INIT_FLAGS	(FANOTIFY_ADMIN_INIT_FLAGS | \
53				 FANOTIFY_USER_INIT_FLAGS)
54
55/* Internal group flags */
56#define FANOTIFY_UNPRIV		0x80000000
57#define FANOTIFY_INTERNAL_GROUP_FLAGS	(FANOTIFY_UNPRIV)
58
59#define FANOTIFY_MARK_TYPE_BITS	(FAN_MARK_INODE | FAN_MARK_MOUNT | \
60				 FAN_MARK_FILESYSTEM)
61
62#define FANOTIFY_MARK_CMD_BITS	(FAN_MARK_ADD | FAN_MARK_REMOVE | \
63				 FAN_MARK_FLUSH)
64
65#define FANOTIFY_MARK_IGNORE_BITS (FAN_MARK_IGNORED_MASK | \
66				   FAN_MARK_IGNORE)
67
68#define FANOTIFY_MARK_FLAGS	(FANOTIFY_MARK_TYPE_BITS | \
69				 FANOTIFY_MARK_CMD_BITS | \
70				 FANOTIFY_MARK_IGNORE_BITS | \
71				 FAN_MARK_DONT_FOLLOW | \
72				 FAN_MARK_ONLYDIR | \
73				 FAN_MARK_IGNORED_SURV_MODIFY | \
74				 FAN_MARK_EVICTABLE)
75
76/*
77 * Events that can be reported with data type FSNOTIFY_EVENT_PATH.
78 * Note that FAN_MODIFY can also be reported with data type
79 * FSNOTIFY_EVENT_INODE.
80 */
81#define FANOTIFY_PATH_EVENTS	(FAN_ACCESS | FAN_MODIFY | \
82				 FAN_CLOSE | FAN_OPEN | FAN_OPEN_EXEC)
83
84/*
85 * Directory entry modification events - reported only to directory
86 * where entry is modified and not to a watching parent.
87 */
88#define FANOTIFY_DIRENT_EVENTS	(FAN_MOVE | FAN_CREATE | FAN_DELETE | \
89				 FAN_RENAME)
90
91/* Events that can be reported with event->fd */
92#define FANOTIFY_FD_EVENTS (FANOTIFY_PATH_EVENTS | FANOTIFY_PERM_EVENTS)
93
94/* Events that can only be reported with data type FSNOTIFY_EVENT_INODE */
95#define FANOTIFY_INODE_EVENTS	(FANOTIFY_DIRENT_EVENTS | \
96				 FAN_ATTRIB | FAN_MOVE_SELF | FAN_DELETE_SELF)
97
98/* Events that can only be reported with data type FSNOTIFY_EVENT_ERROR */
99#define FANOTIFY_ERROR_EVENTS	(FAN_FS_ERROR)
100
101/* Events that user can request to be notified on */
102#define FANOTIFY_EVENTS		(FANOTIFY_PATH_EVENTS | \
103				 FANOTIFY_INODE_EVENTS | \
104				 FANOTIFY_ERROR_EVENTS)
105
106/* Events that require a permission response from user */
107#define FANOTIFY_PERM_EVENTS	(FAN_OPEN_PERM | FAN_ACCESS_PERM | \
108				 FAN_OPEN_EXEC_PERM)
109
110/* Extra flags that may be reported with event or control handling of events */
111#define FANOTIFY_EVENT_FLAGS	(FAN_EVENT_ON_CHILD | FAN_ONDIR)
112
113/* Events that may be reported to user */
114#define FANOTIFY_OUTGOING_EVENTS	(FANOTIFY_EVENTS | \
115					 FANOTIFY_PERM_EVENTS | \
116					 FAN_Q_OVERFLOW | FAN_ONDIR)
117
118/* Events and flags relevant only for directories */
119#define FANOTIFY_DIRONLY_EVENT_BITS	(FANOTIFY_DIRENT_EVENTS | \
120					 FAN_EVENT_ON_CHILD | FAN_ONDIR)
121
122#define ALL_FANOTIFY_EVENT_BITS		(FANOTIFY_OUTGOING_EVENTS | \
123					 FANOTIFY_EVENT_FLAGS)
124
125/* These masks check for invalid bits in permission responses. */
126#define FANOTIFY_RESPONSE_ACCESS (FAN_ALLOW | FAN_DENY)
127#define FANOTIFY_RESPONSE_FLAGS (FAN_AUDIT | FAN_INFO)
128#define FANOTIFY_RESPONSE_VALID_MASK (FANOTIFY_RESPONSE_ACCESS | FANOTIFY_RESPONSE_FLAGS)
129
130/* Do not use these old uapi constants internally */
131#undef FAN_ALL_CLASS_BITS
132#undef FAN_ALL_INIT_FLAGS
133#undef FAN_ALL_MARK_FLAGS
134#undef FAN_ALL_EVENTS
135#undef FAN_ALL_PERM_EVENTS
136#undef FAN_ALL_OUTGOING_EVENTS
137
138#endif /* _LINUX_FANOTIFY_H */
139