1/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
2#ifndef _UAPI_LINUX_FANOTIFY_H
3#define _UAPI_LINUX_FANOTIFY_H
4
5#include <linux/types.h>
6
7/* the following events that user-space can register for */
8#define FAN_ACCESS		0x00000001	/* File was accessed */
9#define FAN_MODIFY		0x00000002	/* File was modified */
10#define FAN_ATTRIB		0x00000004	/* Metadata changed */
11#define FAN_CLOSE_WRITE		0x00000008	/* Writable file closed */
12#define FAN_CLOSE_NOWRITE	0x00000010	/* Unwritable file closed */
13#define FAN_OPEN		0x00000020	/* File was opened */
14#define FAN_MOVED_FROM		0x00000040	/* File was moved from X */
15#define FAN_MOVED_TO		0x00000080	/* File was moved to Y */
16#define FAN_CREATE		0x00000100	/* Subfile was created */
17#define FAN_DELETE		0x00000200	/* Subfile was deleted */
18#define FAN_DELETE_SELF		0x00000400	/* Self was deleted */
19#define FAN_MOVE_SELF		0x00000800	/* Self was moved */
20#define FAN_OPEN_EXEC		0x00001000	/* File was opened for exec */
21
22#define FAN_Q_OVERFLOW		0x00004000	/* Event queued overflowed */
23#define FAN_FS_ERROR		0x00008000	/* Filesystem error */
24
25#define FAN_OPEN_PERM		0x00010000	/* File open in perm check */
26#define FAN_ACCESS_PERM		0x00020000	/* File accessed in perm check */
27#define FAN_OPEN_EXEC_PERM	0x00040000	/* File open/exec in perm check */
28
29#define FAN_EVENT_ON_CHILD	0x08000000	/* Interested in child events */
30
31#define FAN_RENAME		0x10000000	/* File was renamed */
32
33#define FAN_ONDIR		0x40000000	/* Event occurred against dir */
34
35/* helper events */
36#define FAN_CLOSE		(FAN_CLOSE_WRITE | FAN_CLOSE_NOWRITE) /* close */
37#define FAN_MOVE		(FAN_MOVED_FROM | FAN_MOVED_TO) /* moves */
38
39/* flags used for fanotify_init() */
40#define FAN_CLOEXEC		0x00000001
41#define FAN_NONBLOCK		0x00000002
42
43/* These are NOT bitwise flags.  Both bits are used together.  */
44#define FAN_CLASS_NOTIF		0x00000000
45#define FAN_CLASS_CONTENT	0x00000004
46#define FAN_CLASS_PRE_CONTENT	0x00000008
47
48/* Deprecated - do not use this in programs and do not add new flags here! */
49#define FAN_ALL_CLASS_BITS	(FAN_CLASS_NOTIF | FAN_CLASS_CONTENT | \
50				 FAN_CLASS_PRE_CONTENT)
51
52#define FAN_UNLIMITED_QUEUE	0x00000010
53#define FAN_UNLIMITED_MARKS	0x00000020
54#define FAN_ENABLE_AUDIT	0x00000040
55
56/* Flags to determine fanotify event format */
57#define FAN_REPORT_PIDFD	0x00000080	/* Report pidfd for event->pid */
58#define FAN_REPORT_TID		0x00000100	/* event->pid is thread id */
59#define FAN_REPORT_FID		0x00000200	/* Report unique file id */
60#define FAN_REPORT_DIR_FID	0x00000400	/* Report unique directory id */
61#define FAN_REPORT_NAME		0x00000800	/* Report events with name */
62#define FAN_REPORT_TARGET_FID	0x00001000	/* Report dirent target id  */
63
64/* Convenience macro - FAN_REPORT_NAME requires FAN_REPORT_DIR_FID */
65#define FAN_REPORT_DFID_NAME	(FAN_REPORT_DIR_FID | FAN_REPORT_NAME)
66/* Convenience macro - FAN_REPORT_TARGET_FID requires all other FID flags */
67#define FAN_REPORT_DFID_NAME_TARGET (FAN_REPORT_DFID_NAME | \
68				     FAN_REPORT_FID | FAN_REPORT_TARGET_FID)
69
70/* Deprecated - do not use this in programs and do not add new flags here! */
71#define FAN_ALL_INIT_FLAGS	(FAN_CLOEXEC | FAN_NONBLOCK | \
72				 FAN_ALL_CLASS_BITS | FAN_UNLIMITED_QUEUE |\
73				 FAN_UNLIMITED_MARKS)
74
75/* flags used for fanotify_modify_mark() */
76#define FAN_MARK_ADD		0x00000001
77#define FAN_MARK_REMOVE		0x00000002
78#define FAN_MARK_DONT_FOLLOW	0x00000004
79#define FAN_MARK_ONLYDIR	0x00000008
80/* FAN_MARK_MOUNT is		0x00000010 */
81#define FAN_MARK_IGNORED_MASK	0x00000020
82#define FAN_MARK_IGNORED_SURV_MODIFY	0x00000040
83#define FAN_MARK_FLUSH		0x00000080
84/* FAN_MARK_FILESYSTEM is	0x00000100 */
85#define FAN_MARK_EVICTABLE	0x00000200
86/* This bit is mutually exclusive with FAN_MARK_IGNORED_MASK bit */
87#define FAN_MARK_IGNORE		0x00000400
88
89/* These are NOT bitwise flags.  Both bits can be used togther.  */
90#define FAN_MARK_INODE		0x00000000
91#define FAN_MARK_MOUNT		0x00000010
92#define FAN_MARK_FILESYSTEM	0x00000100
93
94/*
95 * Convenience macro - FAN_MARK_IGNORE requires FAN_MARK_IGNORED_SURV_MODIFY
96 * for non-inode mark types.
97 */
98#define FAN_MARK_IGNORE_SURV	(FAN_MARK_IGNORE | FAN_MARK_IGNORED_SURV_MODIFY)
99
100/* Deprecated - do not use this in programs and do not add new flags here! */
101#define FAN_ALL_MARK_FLAGS	(FAN_MARK_ADD |\
102				 FAN_MARK_REMOVE |\
103				 FAN_MARK_DONT_FOLLOW |\
104				 FAN_MARK_ONLYDIR |\
105				 FAN_MARK_MOUNT |\
106				 FAN_MARK_IGNORED_MASK |\
107				 FAN_MARK_IGNORED_SURV_MODIFY |\
108				 FAN_MARK_FLUSH)
109
110/* Deprecated - do not use this in programs and do not add new flags here! */
111#define FAN_ALL_EVENTS (FAN_ACCESS |\
112			FAN_MODIFY |\
113			FAN_CLOSE |\
114			FAN_OPEN)
115
116/*
117 * All events which require a permission response from userspace
118 */
119/* Deprecated - do not use this in programs and do not add new flags here! */
120#define FAN_ALL_PERM_EVENTS (FAN_OPEN_PERM |\
121			     FAN_ACCESS_PERM)
122
123/* Deprecated - do not use this in programs and do not add new flags here! */
124#define FAN_ALL_OUTGOING_EVENTS	(FAN_ALL_EVENTS |\
125				 FAN_ALL_PERM_EVENTS |\
126				 FAN_Q_OVERFLOW)
127
128#define FANOTIFY_METADATA_VERSION	3
129
130struct fanotify_event_metadata {
131	__u32 event_len;
132	__u8 vers;
133	__u8 reserved;
134	__u16 metadata_len;
135	__aligned_u64 mask;
136	__s32 fd;
137	__s32 pid;
138};
139
140#define FAN_EVENT_INFO_TYPE_FID		1
141#define FAN_EVENT_INFO_TYPE_DFID_NAME	2
142#define FAN_EVENT_INFO_TYPE_DFID	3
143#define FAN_EVENT_INFO_TYPE_PIDFD	4
144#define FAN_EVENT_INFO_TYPE_ERROR	5
145
146/* Special info types for FAN_RENAME */
147#define FAN_EVENT_INFO_TYPE_OLD_DFID_NAME	10
148/* Reserved for FAN_EVENT_INFO_TYPE_OLD_DFID	11 */
149#define FAN_EVENT_INFO_TYPE_NEW_DFID_NAME	12
150/* Reserved for FAN_EVENT_INFO_TYPE_NEW_DFID	13 */
151
152/* Variable length info record following event metadata */
153struct fanotify_event_info_header {
154	__u8 info_type;
155	__u8 pad;
156	__u16 len;
157};
158
159/*
160 * Unique file identifier info record.
161 * This structure is used for records of types FAN_EVENT_INFO_TYPE_FID,
162 * FAN_EVENT_INFO_TYPE_DFID and FAN_EVENT_INFO_TYPE_DFID_NAME.
163 * For FAN_EVENT_INFO_TYPE_DFID_NAME there is additionally a null terminated
164 * name immediately after the file handle.
165 */
166struct fanotify_event_info_fid {
167	struct fanotify_event_info_header hdr;
168	__kernel_fsid_t fsid;
169	/*
170	 * Following is an opaque struct file_handle that can be passed as
171	 * an argument to open_by_handle_at(2).
172	 */
173	unsigned char handle[];
174};
175
176/*
177 * This structure is used for info records of type FAN_EVENT_INFO_TYPE_PIDFD.
178 * It holds a pidfd for the pid that was responsible for generating an event.
179 */
180struct fanotify_event_info_pidfd {
181	struct fanotify_event_info_header hdr;
182	__s32 pidfd;
183};
184
185struct fanotify_event_info_error {
186	struct fanotify_event_info_header hdr;
187	__s32 error;
188	__u32 error_count;
189};
190
191/*
192 * User space may need to record additional information about its decision.
193 * The extra information type records what kind of information is included.
194 * The default is none. We also define an extra information buffer whose
195 * size is determined by the extra information type.
196 *
197 * If the information type is Audit Rule, then the information following
198 * is the rule number that triggered the user space decision that
199 * requires auditing.
200 */
201
202#define FAN_RESPONSE_INFO_NONE		0
203#define FAN_RESPONSE_INFO_AUDIT_RULE	1
204
205struct fanotify_response {
206	__s32 fd;
207	__u32 response;
208};
209
210struct fanotify_response_info_header {
211	__u8 type;
212	__u8 pad;
213	__u16 len;
214};
215
216struct fanotify_response_info_audit_rule {
217	struct fanotify_response_info_header hdr;
218	__u32 rule_number;
219	__u32 subj_trust;
220	__u32 obj_trust;
221};
222
223/* Legit userspace responses to a _PERM event */
224#define FAN_ALLOW	0x01
225#define FAN_DENY	0x02
226#define FAN_AUDIT	0x10	/* Bitmask to create audit record for result */
227#define FAN_INFO	0x20	/* Bitmask to indicate additional information */
228
229/* No fd set in event */
230#define FAN_NOFD	-1
231#define FAN_NOPIDFD	FAN_NOFD
232#define FAN_EPIDFD	-2
233
234/* Helper functions to deal with fanotify_event_metadata buffers */
235#define FAN_EVENT_METADATA_LEN (sizeof(struct fanotify_event_metadata))
236
237#define FAN_EVENT_NEXT(meta, len) ((len) -= (meta)->event_len, \
238				   (struct fanotify_event_metadata*)(((char *)(meta)) + \
239				   (meta)->event_len))
240
241#define FAN_EVENT_OK(meta, len)	((long)(len) >= (long)FAN_EVENT_METADATA_LEN && \
242				(long)(meta)->event_len >= (long)FAN_EVENT_METADATA_LEN && \
243				(long)(meta)->event_len <= (long)(len))
244
245#endif /* _UAPI_LINUX_FANOTIFY_H */
246