Commit 66917a31 authored by Matthew Bobrowski's avatar Matthew Bobrowski Committed by Jan Kara
Browse files

fanotify: introduce new event mask FAN_OPEN_EXEC_PERM 



A new event mask FAN_OPEN_EXEC_PERM has been defined. This allows users
to receive events and grant access to files that are intending to be
opened for execution. Events of FAN_OPEN_EXEC_PERM type will be
generated when a file has been opened by using either execve(),
execveat() or uselib() system calls.

This acts in the same manner as previous permission event mask, meaning
that an access response is required from the user application in order
to permit any further operations on the file.

Signed-off-by: default avatarMatthew Bobrowski <mbobrowski@mbobrowski.org>
Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent a704bba5

fs/notify/fanotify/fanotify.c

+2 −1
Original line number Diff line number Diff line
@@ -211,8 +211,9 @@ static int fanotify_handle_event(struct fsnotify_group *group, 
	BUILD_BUG_ON(FAN_ACCESS_PERM != FS_ACCESS_PERM);

	BUILD_BUG_ON(FAN_ONDIR != FS_ISDIR);

	BUILD_BUG_ON(FAN_OPEN_EXEC != FS_OPEN_EXEC);

	BUILD_BUG_ON(FAN_OPEN_EXEC_PERM != FS_OPEN_EXEC_PERM);



	BUILD_BUG_ON(HWEIGHT32(ALL_FANOTIFY_EVENT_BITS) != 11);

	BUILD_BUG_ON(HWEIGHT32(ALL_FANOTIFY_EVENT_BITS) != 12);



	mask = fanotify_group_event_mask(iter_info, mask, data, data_type);

	if (!mask)

fs/notify/fsnotify.c

+1 −1
Original line number Diff line number Diff line
@@ -401,7 +401,7 @@ static __init int fsnotify_init(void) 
{

	int ret;



	BUILD_BUG_ON(HWEIGHT32(ALL_FSNOTIFY_BITS) != 24);

	BUILD_BUG_ON(HWEIGHT32(ALL_FSNOTIFY_BITS) != 25);



	ret = init_srcu_struct(&fsnotify_mark_srcu);

	if (ret)

include/linux/fanotify.h

+2 −1
Original line number Diff line number Diff line
@@ -40,7 +40,8 @@ 
				 FAN_CLOSE | FAN_OPEN | FAN_OPEN_EXEC)



/* Events that require a permission response from user */

#define FANOTIFY_PERM_EVENTS	(FAN_OPEN_PERM | FAN_ACCESS_PERM)

#define FANOTIFY_PERM_EVENTS	(FAN_OPEN_PERM | FAN_ACCESS_PERM | \

				 FAN_OPEN_EXEC_PERM)



/* Extra flags that may be reported with event or control handling of events */

#define FANOTIFY_EVENT_FLAGS	(FAN_EVENT_ON_CHILD | FAN_ONDIR)

include/linux/fsnotify.h

+12 −5
Original line number Diff line number Diff line
@@ -40,9 +40,10 @@ static inline int fsnotify_path(struct inode *inode, const struct path *path, 
	return fsnotify(inode, mask, path, FSNOTIFY_EVENT_PATH, NULL, 0);

}



/* simple call site for access decisions */

/* Simple call site for access decisions */

static inline int fsnotify_perm(struct file *file, int mask)

{

	int ret;

	const struct path *path = &file->f_path;

	struct inode *inode = file_inode(file);

	__u32 fsnotify_mask = 0;
@@ -51,12 +52,18 @@ static inline int fsnotify_perm(struct file *file, int mask) 
		return 0;

	if (!(mask & (MAY_READ | MAY_OPEN)))

		return 0;

	if (mask & MAY_OPEN)

	if (mask & MAY_OPEN) {

		fsnotify_mask = FS_OPEN_PERM;

	else if (mask & MAY_READ)



		if (file->f_flags & __FMODE_EXEC) {

			ret = fsnotify_path(inode, path, FS_OPEN_EXEC_PERM);



			if (ret)

				return ret;

		}

	} else if (mask & MAY_READ) {

		fsnotify_mask = FS_ACCESS_PERM;

	else

		BUG();

	}



	return fsnotify_path(inode, path, fsnotify_mask);

}

include/linux/fsnotify_backend.h

+5 −3
Original line number Diff line number Diff line
@@ -46,6 +46,7 @@ 


#define FS_OPEN_PERM		0x00010000	/* open event in an permission hook */

#define FS_ACCESS_PERM		0x00020000	/* access event in a permissions hook */

#define FS_OPEN_EXEC_PERM	0x00040000	/* open/exec event in a permission hook */



#define FS_EXCL_UNLINK		0x04000000	/* do not send events if object is unlinked */

#define FS_ISDIR		0x40000000	/* event occurred against dir */
@@ -64,11 +65,12 @@ 
				   FS_CLOSE_WRITE | FS_CLOSE_NOWRITE | FS_OPEN |\

				   FS_MOVED_FROM | FS_MOVED_TO | FS_CREATE |\

				   FS_DELETE | FS_OPEN_PERM | FS_ACCESS_PERM | \

				   FS_OPEN_EXEC)

				   FS_OPEN_EXEC | FS_OPEN_EXEC_PERM)



#define FS_MOVE			(FS_MOVED_FROM | FS_MOVED_TO)



#define ALL_FSNOTIFY_PERM_EVENTS (FS_OPEN_PERM | FS_ACCESS_PERM)

#define ALL_FSNOTIFY_PERM_EVENTS (FS_OPEN_PERM | FS_ACCESS_PERM | \

				  FS_OPEN_EXEC_PERM)



/* Events that can be reported to backends */

#define ALL_FSNOTIFY_EVENTS (FS_ACCESS | FS_MODIFY | FS_ATTRIB | \
@@ -77,7 +79,7 @@ 
			     FS_DELETE | FS_DELETE_SELF | FS_MOVE_SELF | \

			     FS_UNMOUNT | FS_Q_OVERFLOW | FS_IN_IGNORED | \

			     FS_OPEN_PERM | FS_ACCESS_PERM | FS_DN_RENAME | \

			     FS_OPEN_EXEC)

			     FS_OPEN_EXEC | FS_OPEN_EXEC_PERM)



/* Extra flags that may be reported with event or control handling of events */

#define ALL_FSNOTIFY_FLAGS  (FS_EXCL_UNLINK | FS_ISDIR | FS_IN_ONESHOT | \

CRA Git | Maintained and supported by SUSTech CRA and CCSE