[PATCH v2 0/4] fanotify man page updates for v5.13

[PATCH v2 0/4] fanotify man page updates for v5.13

[Amir Goldstein]

Hi Alejandro,

This is a re-post of updates for v5.13 that I posted last March [1].

Thanks,
Amir.

Changes since v1:
- Update comment regarding tmpfs
- Document kernel commits

[1] https://lore.kernel.org/linux-man/20210318160817.3586288-1-amir73il@gmail.com/

Amir Goldstein (3):
  fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits
  fanotify_mark.2: Update w.r.t tmpfs support
  fanotify_init.2: Document kernel commits

Matthew Bobrowski (1):
  fanotify_init.2, fanotify_mark.2: Document unprivileged listener

 man2/fanotify_init.2 | 101 +++++++++++++++++++++++++++++++++++--------
 man2/fanotify_mark.2 |  21 ++++++++-
 man7/fanotify.7      |  35 ++++++++++++++-
 3 files changed, 135 insertions(+), 22 deletions(-)

-- 
2.33.1

[PATCH v2 1/4] fanotify_init.2, fanotify_mark.2: Document unprivileged listener

[Amir Goldstein]

From: Matthew Bobrowski <mbobrowski@mbobrowski.org>

Document the limited fanotify functionality that will be available for
unprivileged users from kernel v5.13.

Signed-off-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
 man2/fanotify_init.2 | 77 +++++++++++++++++++++++++++++++++++++-------
 man2/fanotify_mark.2 |  9 ++++++
 2 files changed, 74 insertions(+), 12 deletions(-)

diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index 2b44fc6ec..b2ceb17f3 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -57,15 +57,6 @@ In the current implementation, the number of fanotify groups per user is
 limited to 128.
 This limit cannot be overridden.
 .PP
-Calling
-.BR fanotify_init ()
-requires the
-.B CAP_SYS_ADMIN
-capability.
-This constraint might be relaxed in future versions of the API.
-Therefore, certain additional capability checks have been implemented as
-indicated below.
-.PP
 The
 .I flags
 argument contains a multi-bit field defining the notification class of the
@@ -86,6 +77,9 @@ It is intended for event listeners that need to access files before they
 contain their final data.
 This notification class might be used by hierarchical storage managers,
 for example.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
 .TP
 .B FAN_CLASS_CONTENT
 This value allows the receipt of events notifying that a file has been
@@ -94,6 +88,9 @@ It is intended for event listeners that need to access files when they
 already contain their final content.
 This notification class might be used by malware detection programs, for
 example.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
 .TP
 .B FAN_CLASS_NOTIF
 This is the default value.
@@ -155,6 +152,9 @@ supplied to
 .BR read (2)
 (see
 .BR fanotify (7)).
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
 .TP
 .BR FAN_ENABLE_AUDIT " (since Linux 4.15)"
 .\" commit de8cd83e91bc3ee212b3e6ec6e4283af9e4ab269
@@ -163,6 +163,9 @@ permission events.
 The permission event response has to be marked with the
 .B FAN_AUDIT
 flag for an audit log record to be generated.
+Use of this flag requires the
+.B CAP_AUDIT_WRITE
+capability.
 .TP
 .BR FAN_REPORT_FID " (since Linux 5.1)"
 .\" commit a8b13aa20afb69161b5123b4f1acc7ea0a03d360
@@ -378,13 +381,63 @@ The fanotify API is available only if the kernel was configured with
 .BR CONFIG_FANOTIFY .
 .TP
 .B EPERM
-The operation is not permitted because the caller lacks the
-.B CAP_SYS_ADMIN
-capability.
+The operation is not permitted because the caller lacks a required capability.
 .SH VERSIONS
 .BR fanotify_init ()
 was introduced in version 2.6.36 of the Linux kernel and enabled in version
 2.6.37.
+.PP
+Prior to Linux 5.13,
+.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
+calling
+.BR fanotify_init ()
+required the
+.B CAP_SYS_ADMIN
+capability.
+Since Linux 5.13,
+.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
+users may call
+.BR fanotify_init ()
+without the
+.B CAP_SYS_ADMIN
+capability to create and intialize an fanotify group with limited functionality.
+.TP
+The limitations imposed on an event listener created by a user without the
+.B CAP_SYS_ADMIN
+capability are as follows:
+.RS
+.IP * 3
+The user cannot request for an unlimited event queue by using
+.BR FAN_UNLIMITED_QUEUE .
+.IP * 3
+The user cannot request for an unlimited number of marks by using
+.BR FAN_UNLIMITED_MARKS .
+.IP * 3
+The user cannot request to use either notification classes
+.BR FAN_CLASS_CONTENT
+or
+.BR FAN_CLASS_PRE_CONTENT .
+This means that user cannot request permission events.
+.IP * 3
+The user is required to create a group that identifies filesystem objects by
+file handles, for example, by providing the
+.BR FAN_REPORT_FID
+flag.
+.IP * 3
+The user is limited to only mark inodes.
+The ability to mark a mount or filesystem via
+.BR fanotify_mark()
+through the use of
+.BR FAN_MARK_MOUNT
+or
+.BR FAN_MARK_FILESYSTEM
+is not permitted.
+.IP * 3
+The event object in the event queue is limited in terms of the information
+that is made available to the unprivileged user.
+A user will also not receive the pid that generated the event, unless the
+listening process itself generated the event.
+.RE
 .SH CONFORMING TO
 This system call is Linux-specific.
 .SH BUGS
diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
index 036f56ebf..9cf71320c 100644
--- a/man2/fanotify_mark.2
+++ b/man2/fanotify_mark.2
@@ -142,6 +142,9 @@ contains
 Attempting to do so will result in the error
 .B EINVAL
 being returned.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
 .TP
 .BR FAN_MARK_FILESYSTEM " (since Linux 4.20)"
 .\" commit d54f4fba889b205e9cd8239182ca5d27d0ac3bc2
@@ -152,6 +155,9 @@ The filesystem containing
 will be marked.
 All the contained files and directories of the filesystem from any mount
 point will be monitored.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
 .TP
 .B FAN_MARK_IGNORED_MASK
 The events in
@@ -454,6 +460,9 @@ handles.
 This error can be returned only with an fanotify group that identifies
 filesystem objects by file handles.
 .TP
+.B EPERM
+The operation is not permitted because the caller lacks a required capability.
+.TP
 .B EXDEV
 The filesystem object indicated by
 .I pathname
-- 
2.33.1

[PATCH v2 2/4] fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits

[Amir Goldstein]

Update documentation about the new configurable fanotify limits
that will be available from Linux kernel 5.13.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
 man2/fanotify_init.2 | 22 ++++++++++++++++------
 man2/fanotify_mark.2 |  5 ++++-
 man7/fanotify.7      | 35 +++++++++++++++++++++++++++++++++--
 3 files changed, 53 insertions(+), 9 deletions(-)

diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index b2ceb17f3..0d83e817f 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -53,9 +53,10 @@ descriptor.
 Multiple programs may be using the fanotify interface at the same time to
 monitor the same files.
 .PP
-In the current implementation, the number of fanotify groups per user is
-limited to 128.
-This limit cannot be overridden.
+The number of fanotify groups per user is limited.
+See
+.BR fanotify (7)
+for details about this limit.
 .PP
 The
 .I flags
@@ -130,13 +131,19 @@ fails with the error
 .BR EAGAIN .
 .TP
 .B FAN_UNLIMITED_QUEUE
-Remove the limit of 16384 events for the event queue.
+Remove the limit on the number of events in the event queue.
+See
+.BR fanotify (7)
+for details about this limit.
 Use of this flag requires the
 .B CAP_SYS_ADMIN
 capability.
 .TP
 .B FAN_UNLIMITED_MARKS
-Remove the limit of 8192 marks.
+Remove the limit on the number of fanotify marks per user.
+See
+.BR fanotify (7)
+for details about this limit.
 Use of this flag requires the
 .B CAP_SYS_ADMIN
 capability.
@@ -366,7 +373,10 @@ defines all allowable bits for
 .IR flags .
 .TP
 .B EMFILE
-The number of fanotify groups for this user exceeds 128.
+The number of fanotify groups for this user exceeds the limit.
+See
+.BR fanotify (7)
+for details about this limit.
 .TP
 .B EMFILE
 The per-process limit on the number of open file descriptors has been reached.
diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
index 9cf71320c..cb69ac592 100644
--- a/man2/fanotify_mark.2
+++ b/man2/fanotify_mark.2
@@ -431,10 +431,13 @@ which is not marked.
 The necessary memory could not be allocated.
 .TP
 .B ENOSPC
-The number of marks exceeds the limit of 8192 and the
+The number of marks for this user exceeds the limit and the
 .B FAN_UNLIMITED_MARKS
 flag was not specified when the fanotify file descriptor was created with
 .BR fanotify_init (2).
+See
+.BR fanotify (7)
+for details about this limit.
 .TP
 .B ENOSYS
 This kernel does not implement
diff --git a/man7/fanotify.7 b/man7/fanotify.7
index 9c66c24f0..455e3ed17 100644
--- a/man7/fanotify.7
+++ b/man7/fanotify.7
@@ -336,7 +336,7 @@ A file or directory that was opened read-only
 was closed.
 .TP
 .B FAN_Q_OVERFLOW
-The event queue exceeded the limit of 16384 entries.
+The event queue exceeded the limit on number of events.
 This limit can be overridden by specifying the
 .BR FAN_UNLIMITED_QUEUE
 flag when calling
@@ -606,7 +606,7 @@ are freed for reuse by the kernel.
 Upon
 .BR close (2),
 outstanding permission events will be set to allowed.
-.SS /proc/[pid]/fdinfo
+.SS /proc interfaces
 The file
 .I /proc/[pid]/fdinfo/[fd]
 contains information about fanotify marks for file descriptor
@@ -616,6 +616,37 @@ of process
 See
 .BR proc (5)
 for details.
+.PP
+Since Linux 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the following interfaces can be used to control the amount of
+kernel resources consumed by fanotify:
+.TP
+.I /proc/sys/fs/fanotify/max_queued_events
+The value in this file is used when an application calls
+.BR fanotify_init (2)
+to set an upper limit on the number of events that can be
+queued to the corresponding fanotify group.
+Events in excess of this limit are dropped, but an
+.B FAN_Q_OVERFLOW
+event is always generated.
+Prior to Linux kernel 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the hardcoded limit was 16384 events.
+.TP
+.I /proc/sys/fs/fanotify/max_user_group
+This specifies an upper limit on the number of fanotify groups
+that can be created per real user ID.
+Prior to Linux kernel 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the hardcoded limit was 128 groups per user.
+.TP
+.I /proc/sys/fs/fanotify/max_user_marks
+This specifies an upper limit on the number of fanotify marks
+that can be created per real user ID.
+Prior to Linux kernel 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the hardcoded limit was 8192 marks per group (not per user).
 .SH ERRORS
 In addition to the usual errors for
 .BR read (2),
-- 
2.33.1

[PATCH v2 3/4] fanotify_mark.2: Update w.r.t tmpfs support

[Amir Goldstein]

tmpfs can be watched with FAN_REPORT_FID since kernel v5.13.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
 man2/fanotify_mark.2 | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
index cb69ac592..92309e684 100644
--- a/man2/fanotify_mark.2
+++ b/man2/fanotify_mark.2
@@ -414,7 +414,12 @@ The filesystem object indicated by
 is not associated with a filesystem that supports
 .I fsid
 (e.g.,
-.BR tmpfs (5)).
+.BR fuse (4)).
+.BR tmpfs (5)
+did not support
+.I fsid
+prior to Linux 5.13.
+.\" commit 59cda49ecf6c9a32fae4942420701b6e087204f6
 This error can be returned only with an fanotify group that identifies
 filesystem objects by file handles.
 .TP
-- 
2.33.1

[PATCH v2 4/4] fanotify_init.2: Document kernel commits

[Amir Goldstein]

Document the kernel commits that added support for FAN_REPORT_DIR_FID
and FAN_REPORT_NAME.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
 man2/fanotify_init.2 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index 0d83e817f..7a1c21037 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -213,6 +213,7 @@ See
 for additional details.
 .TP
 .BR FAN_REPORT_DIR_FID " (since Linux 5.9)"
+.\" commit 83b7a59896dd24015a34b7f00027f0ff3747972f
 Events for fanotify groups initialized with this flag will contain
 (see exceptions below) additional information about a directory object
 correlated to an event.
@@ -245,6 +246,7 @@ See
 for additional details.
 .TP
 .BR FAN_REPORT_NAME " (since Linux 5.9)"
+.\" commit 929943b38daf817f2e6d303ea04401651fc3bc05
 Events for fanotify groups initialized with this flag will contain additional
 information about the name of the directory entry correlated to an event.
 This flag must be provided in conjunction with the flag
-- 
2.33.1

Re: [PATCH v2 1/4] fanotify_init.2, fanotify_mark.2: Document unprivileged listener

[Amir Goldstein]

On Sat, Nov 20, 2021 at 7:12 PM Amir Goldstein <amir73il@gmail.com> wrote:
>
> From: Matthew Bobrowski <mbobrowski@mbobrowski.org>
>
> Document the limited fanotify functionality that will be available for
> unprivileged users from kernel v5.13.
>
> Signed-off-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
> Signed-off-by: Amir Goldstein <amir73il@gmail.com>

Forgot to add
Reviewed-by: Jan Kara <jack@suse.cz>

From:
https://lore.kernel.org/linux-man/20210319102532.GA4910@quack2.suse.cz/

> ---
>  man2/fanotify_init.2 | 77 +++++++++++++++++++++++++++++++++++++-------
>  man2/fanotify_mark.2 |  9 ++++++
>  2 files changed, 74 insertions(+), 12 deletions(-)
>
> diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
> index 2b44fc6ec..b2ceb17f3 100644
> --- a/man2/fanotify_init.2
> +++ b/man2/fanotify_init.2
> @@ -57,15 +57,6 @@ In the current implementation, the number of fanotify groups per user is
>  limited to 128.
>  This limit cannot be overridden.
>  .PP
> -Calling
> -.BR fanotify_init ()
> -requires the
> -.B CAP_SYS_ADMIN
> -capability.
> -This constraint might be relaxed in future versions of the API.
> -Therefore, certain additional capability checks have been implemented as
> -indicated below.
> -.PP
>  The
>  .I flags
>  argument contains a multi-bit field defining the notification class of the
> @@ -86,6 +77,9 @@ It is intended for event listeners that need to access files before they
>  contain their final data.
>  This notification class might be used by hierarchical storage managers,
>  for example.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
>  .TP
>  .B FAN_CLASS_CONTENT
>  This value allows the receipt of events notifying that a file has been
> @@ -94,6 +88,9 @@ It is intended for event listeners that need to access files when they
>  already contain their final content.
>  This notification class might be used by malware detection programs, for
>  example.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
>  .TP
>  .B FAN_CLASS_NOTIF
>  This is the default value.
> @@ -155,6 +152,9 @@ supplied to
>  .BR read (2)
>  (see
>  .BR fanotify (7)).
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
>  .TP
>  .BR FAN_ENABLE_AUDIT " (since Linux 4.15)"
>  .\" commit de8cd83e91bc3ee212b3e6ec6e4283af9e4ab269
> @@ -163,6 +163,9 @@ permission events.
>  The permission event response has to be marked with the
>  .B FAN_AUDIT
>  flag for an audit log record to be generated.
> +Use of this flag requires the
> +.B CAP_AUDIT_WRITE
> +capability.
>  .TP
>  .BR FAN_REPORT_FID " (since Linux 5.1)"
>  .\" commit a8b13aa20afb69161b5123b4f1acc7ea0a03d360
> @@ -378,13 +381,63 @@ The fanotify API is available only if the kernel was configured with
>  .BR CONFIG_FANOTIFY .
>  .TP
>  .B EPERM
> -The operation is not permitted because the caller lacks the
> -.B CAP_SYS_ADMIN
> -capability.
> +The operation is not permitted because the caller lacks a required capability.
>  .SH VERSIONS
>  .BR fanotify_init ()
>  was introduced in version 2.6.36 of the Linux kernel and enabled in version
>  2.6.37.
> +.PP
> +Prior to Linux 5.13,
> +.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
> +calling
> +.BR fanotify_init ()
> +required the
> +.B CAP_SYS_ADMIN
> +capability.
> +Since Linux 5.13,
> +.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
> +users may call
> +.BR fanotify_init ()
> +without the
> +.B CAP_SYS_ADMIN
> +capability to create and intialize an fanotify group with limited functionality.
> +.TP
> +The limitations imposed on an event listener created by a user without the
> +.B CAP_SYS_ADMIN
> +capability are as follows:
> +.RS
> +.IP * 3
> +The user cannot request for an unlimited event queue by using
> +.BR FAN_UNLIMITED_QUEUE .
> +.IP * 3
> +The user cannot request for an unlimited number of marks by using
> +.BR FAN_UNLIMITED_MARKS .
> +.IP * 3
> +The user cannot request to use either notification classes
> +.BR FAN_CLASS_CONTENT
> +or
> +.BR FAN_CLASS_PRE_CONTENT .
> +This means that user cannot request permission events.
> +.IP * 3
> +The user is required to create a group that identifies filesystem objects by
> +file handles, for example, by providing the
> +.BR FAN_REPORT_FID
> +flag.
> +.IP * 3
> +The user is limited to only mark inodes.
> +The ability to mark a mount or filesystem via
> +.BR fanotify_mark()
> +through the use of
> +.BR FAN_MARK_MOUNT
> +or
> +.BR FAN_MARK_FILESYSTEM
> +is not permitted.
> +.IP * 3
> +The event object in the event queue is limited in terms of the information
> +that is made available to the unprivileged user.
> +A user will also not receive the pid that generated the event, unless the
> +listening process itself generated the event.
> +.RE
>  .SH CONFORMING TO
>  This system call is Linux-specific.
>  .SH BUGS
> diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
> index 036f56ebf..9cf71320c 100644
> --- a/man2/fanotify_mark.2
> +++ b/man2/fanotify_mark.2
> @@ -142,6 +142,9 @@ contains
>  Attempting to do so will result in the error
>  .B EINVAL
>  being returned.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
>  .TP
>  .BR FAN_MARK_FILESYSTEM " (since Linux 4.20)"
>  .\" commit d54f4fba889b205e9cd8239182ca5d27d0ac3bc2
> @@ -152,6 +155,9 @@ The filesystem containing
>  will be marked.
>  All the contained files and directories of the filesystem from any mount
>  point will be monitored.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
>  .TP
>  .B FAN_MARK_IGNORED_MASK
>  The events in
> @@ -454,6 +460,9 @@ handles.
>  This error can be returned only with an fanotify group that identifies
>  filesystem objects by file handles.
>  .TP
> +.B EPERM
> +The operation is not permitted because the caller lacks a required capability.
> +.TP
>  .B EXDEV
>  The filesystem object indicated by
>  .I pathname
> --
> 2.33.1
>

Re: [PATCH v2 2/4] fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits

[Amir Goldstein]

On Sat, Nov 20, 2021 at 7:12 PM Amir Goldstein <amir73il@gmail.com> wrote:
>
> Update documentation about the new configurable fanotify limits
> that will be available from Linux kernel 5.13.
>
> Signed-off-by: Amir Goldstein <amir73il@gmail.com>

Forgot to add
Reviewed-by: Jan Kara <jack@suse.cz>

From:
https://lore.kernel.org/linux-man/20210319102532.GA4910@quack2.suse.cz/

> ---
>  man2/fanotify_init.2 | 22 ++++++++++++++++------
>  man2/fanotify_mark.2 |  5 ++++-
>  man7/fanotify.7      | 35 +++++++++++++++++++++++++++++++++--
>  3 files changed, 53 insertions(+), 9 deletions(-)
>
> diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
> index b2ceb17f3..0d83e817f 100644
> --- a/man2/fanotify_init.2
> +++ b/man2/fanotify_init.2
> @@ -53,9 +53,10 @@ descriptor.
>  Multiple programs may be using the fanotify interface at the same time to
>  monitor the same files.
>  .PP
> -In the current implementation, the number of fanotify groups per user is
> -limited to 128.
> -This limit cannot be overridden.
> +The number of fanotify groups per user is limited.
> +See
> +.BR fanotify (7)
> +for details about this limit.
>  .PP
>  The
>  .I flags
> @@ -130,13 +131,19 @@ fails with the error
>  .BR EAGAIN .
>  .TP
>  .B FAN_UNLIMITED_QUEUE
> -Remove the limit of 16384 events for the event queue.
> +Remove the limit on the number of events in the event queue.
> +See
> +.BR fanotify (7)
> +for details about this limit.
>  Use of this flag requires the
>  .B CAP_SYS_ADMIN
>  capability.
>  .TP
>  .B FAN_UNLIMITED_MARKS
> -Remove the limit of 8192 marks.
> +Remove the limit on the number of fanotify marks per user.
> +See
> +.BR fanotify (7)
> +for details about this limit.
>  Use of this flag requires the
>  .B CAP_SYS_ADMIN
>  capability.
> @@ -366,7 +373,10 @@ defines all allowable bits for
>  .IR flags .
>  .TP
>  .B EMFILE
> -The number of fanotify groups for this user exceeds 128.
> +The number of fanotify groups for this user exceeds the limit.
> +See
> +.BR fanotify (7)
> +for details about this limit.
>  .TP
>  .B EMFILE
>  The per-process limit on the number of open file descriptors has been reached.
> diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
> index 9cf71320c..cb69ac592 100644
> --- a/man2/fanotify_mark.2
> +++ b/man2/fanotify_mark.2
> @@ -431,10 +431,13 @@ which is not marked.
>  The necessary memory could not be allocated.
>  .TP
>  .B ENOSPC
> -The number of marks exceeds the limit of 8192 and the
> +The number of marks for this user exceeds the limit and the
>  .B FAN_UNLIMITED_MARKS
>  flag was not specified when the fanotify file descriptor was created with
>  .BR fanotify_init (2).
> +See
> +.BR fanotify (7)
> +for details about this limit.
>  .TP
>  .B ENOSYS
>  This kernel does not implement
> diff --git a/man7/fanotify.7 b/man7/fanotify.7
> index 9c66c24f0..455e3ed17 100644
> --- a/man7/fanotify.7
> +++ b/man7/fanotify.7
> @@ -336,7 +336,7 @@ A file or directory that was opened read-only
>  was closed.
>  .TP
>  .B FAN_Q_OVERFLOW
> -The event queue exceeded the limit of 16384 entries.
> +The event queue exceeded the limit on number of events.
>  This limit can be overridden by specifying the
>  .BR FAN_UNLIMITED_QUEUE
>  flag when calling
> @@ -606,7 +606,7 @@ are freed for reuse by the kernel.
>  Upon
>  .BR close (2),
>  outstanding permission events will be set to allowed.
> -.SS /proc/[pid]/fdinfo
> +.SS /proc interfaces
>  The file
>  .I /proc/[pid]/fdinfo/[fd]
>  contains information about fanotify marks for file descriptor
> @@ -616,6 +616,37 @@ of process
>  See
>  .BR proc (5)
>  for details.
> +.PP
> +Since Linux 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the following interfaces can be used to control the amount of
> +kernel resources consumed by fanotify:
> +.TP
> +.I /proc/sys/fs/fanotify/max_queued_events
> +The value in this file is used when an application calls
> +.BR fanotify_init (2)
> +to set an upper limit on the number of events that can be
> +queued to the corresponding fanotify group.
> +Events in excess of this limit are dropped, but an
> +.B FAN_Q_OVERFLOW
> +event is always generated.
> +Prior to Linux kernel 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the hardcoded limit was 16384 events.
> +.TP
> +.I /proc/sys/fs/fanotify/max_user_group
> +This specifies an upper limit on the number of fanotify groups
> +that can be created per real user ID.
> +Prior to Linux kernel 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the hardcoded limit was 128 groups per user.
> +.TP
> +.I /proc/sys/fs/fanotify/max_user_marks
> +This specifies an upper limit on the number of fanotify marks
> +that can be created per real user ID.
> +Prior to Linux kernel 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the hardcoded limit was 8192 marks per group (not per user).
>  .SH ERRORS
>  In addition to the usual errors for
>  .BR read (2),
> --
> 2.33.1
>

Re: [PATCH v2 0/4] fanotify man page updates for v5.13

[Alejandro Colomar (man-pages)]

Hi Amir,

On 11/20/21 18:12, Amir Goldstein wrote:
> Hi Alejandro,
> 
> This is a re-post of updates for v5.13 that I posted last March [1].
> 
> Thanks,
> Amir.
> 
> Changes since v1:
> - Update comment regarding tmpfs
> - Document kernel commits
> 
> [1] https://lore.kernel.org/linux-man/20210318160817.3586288-1-amir73il@gmail.com/
> 
> Amir Goldstein (3):
>    fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits
>    fanotify_mark.2: Update w.r.t tmpfs support
>    fanotify_init.2: Document kernel commits
> 
> Matthew Bobrowski (1):
>    fanotify_init.2, fanotify_mark.2: Document unprivileged listener

Patch set applied.
See some tweaks below.

Thanks!
Alex

---
     fanotify_init.2: Minor tweaks to Matthew's patch

     Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
     Cc: Matthew Bobrowski <mbobrowski@mbobrowski.org>
     Cc: Amir Goldstein <amir73il@gmail.com>

diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index 7a1c21037..e463372f3 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -426,23 +426,23 @@ The user cannot request for an unlimited number of 
marks by using
  .BR FAN_UNLIMITED_MARKS .
  .IP * 3
  The user cannot request to use either notification classes
-.BR FAN_CLASS_CONTENT
+.B FAN_CLASS_CONTENT
  or
  .BR FAN_CLASS_PRE_CONTENT .
  This means that user cannot request permission events.
  .IP * 3
  The user is required to create a group that identifies filesystem 
objects by
  file handles, for example, by providing the
-.BR FAN_REPORT_FID
+.B FAN_REPORT_FID
  flag.
  .IP * 3
  The user is limited to only mark inodes.
  The ability to mark a mount or filesystem via
-.BR fanotify_mark()
+.BR fanotify_mark ()
  through the use of
-.BR FAN_MARK_MOUNT
+.B FAN_MARK_MOUNT
  or
-.BR FAN_MARK_FILESYSTEM
+.B FAN_MARK_FILESYSTEM
  is not permitted.
  .IP * 3
  The event object in the event queue is limited in terms of the information


-- 
Alejandro Colomar
Linux man-pages comaintainer; http://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/

Re: [PATCH v2 0/4] fanotify man page updates for v5.13

[Amir Goldstein]

On Mon, Nov 22, 2021 at 6:57 PM Alejandro Colomar (man-pages)
<alx.manpages@gmail.com> wrote:
>
> Hi Amir,
>
> On 11/20/21 18:12, Amir Goldstein wrote:
> > Hi Alejandro,
> >
> > This is a re-post of updates for v5.13 that I posted last March [1].
> >
> > Thanks,
> > Amir.
> >
> > Changes since v1:
> > - Update comment regarding tmpfs
> > - Document kernel commits
> >
> > [1] https://lore.kernel.org/linux-man/20210318160817.3586288-1-amir73il@gmail.com/
> >
> > Amir Goldstein (3):
> >    fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits
> >    fanotify_mark.2: Update w.r.t tmpfs support
> >    fanotify_init.2: Document kernel commits
> >
> > Matthew Bobrowski (1):
> >    fanotify_init.2, fanotify_mark.2: Document unprivileged listener
>
> Patch set applied.
> See some tweaks below.
>

I understand that the patches were applied to your github tree main branch [1]

Should we regard that branch as the "next" branch and base our next
fanotify man page updates (i.e. FAN_REPORT_PIDFD) on top of it?

Thanks,
Amir.

[1] https://github.com/alejandro-colomar/man-pages.git

Re: [PATCH v2 0/4] fanotify man page updates for v5.13

[Alejandro Colomar (man-pages)]

Hi, Amir!

On 12/10/21 10:37, Amir Goldstein wrote:
> On Mon, Nov 22, 2021 at 6:57 PM Alejandro Colomar (man-pages)
> <alx.manpages@gmail.com> wrote:
>> Patch set applied.
>> See some tweaks below.
>>
> 
> I understand that the patches were applied to your github tree main branch [1]

Yes.

> 
> Should we regard that branch as the "next" branch and base our next
> fanotify man page updates (i.e. FAN_REPORT_PIDFD) on top of it?

And yes.

Thanks,
Alex

-- 
Alejandro Colomar
Linux man-pages maintainer; https://www.kernel.org/doc/man-pages/