diff options
| author | Amir Goldstein <amir73il@gmail.com> | 2025-05-16 21:28:03 +0200 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2025-05-19 22:46:34 +0200 |
| commit | 58f5fbeb367ff6f30a2448b2cad70f70b2de4b06 (patch) | |
| tree | 079ca8d6481fcdd10d2ca7f21fde91841fed6217 /include/linux/fanotify.h | |
| parent | 90d1238047a6479674db4b35264e9519186af9e8 (diff) | |
fanotify: support watching filesystems and mounts inside userns
An unprivileged user is allowed to create an fanotify group and add
inode marks, but not filesystem, mntns and mount marks.
Add limited support for setting up filesystem, mntns and mount marks by
an unprivileged user under the following conditions:
1. User has CAP_SYS_ADMIN in the user ns where the group was created
2.a. User has CAP_SYS_ADMIN in the user ns where the sb was created
OR (in case setting up a mntns mark)
2.b. User has CAP_SYS_ADMIN in the user ns associated with the mntns
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20250516192803.838659-3-amir73il@gmail.com
Diffstat (limited to 'include/linux/fanotify.h')
| -rw-r--r-- | include/linux/fanotify.h | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/include/linux/fanotify.h b/include/linux/fanotify.h index 3c817dc6292e..879cff5eccd4 100644 --- a/include/linux/fanotify.h +++ b/include/linux/fanotify.h @@ -38,8 +38,7 @@ FAN_REPORT_PIDFD | \ FAN_REPORT_FD_ERROR | \ FAN_UNLIMITED_QUEUE | \ - FAN_UNLIMITED_MARKS | \ - FAN_REPORT_MNT) + FAN_UNLIMITED_MARKS) /* * fanotify_init() flags that are allowed for user without CAP_SYS_ADMIN. @@ -48,7 +47,7 @@ * so one of the flags for reporting file handles is required. */ #define FANOTIFY_USER_INIT_FLAGS (FAN_CLASS_NOTIF | \ - FANOTIFY_FID_BITS | \ + FANOTIFY_FID_BITS | FAN_REPORT_MNT | \ FAN_CLOEXEC | FAN_NONBLOCK) #define FANOTIFY_INIT_FLAGS (FANOTIFY_ADMIN_INIT_FLAGS | \ |