* [PATCH v2 1/4] fanotify_init.2, fanotify_mark.2: Document unprivileged listener
2021-11-20 17:12 [PATCH v2 0/4] fanotify man page updates for v5.13 Amir Goldstein
@ 2021-11-20 17:12 ` Amir Goldstein
2021-11-20 17:19 ` Amir Goldstein
2021-11-20 17:12 ` [PATCH v2 2/4] fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits Amir Goldstein
` (3 subsequent siblings)
4 siblings, 1 reply; 10+ messages in thread
From: Amir Goldstein @ 2021-11-20 17:12 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: Michael Kerrisk, Jan Kara, Matthew Bobrowski, linux-man
From: Matthew Bobrowski <mbobrowski@mbobrowski.org>
Document the limited fanotify functionality that will be available for
unprivileged users from kernel v5.13.
Signed-off-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
man2/fanotify_init.2 | 77 +++++++++++++++++++++++++++++++++++++-------
man2/fanotify_mark.2 | 9 ++++++
2 files changed, 74 insertions(+), 12 deletions(-)
diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index 2b44fc6ec..b2ceb17f3 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -57,15 +57,6 @@ In the current implementation, the number of fanotify groups per user is
limited to 128.
This limit cannot be overridden.
.PP
-Calling
-.BR fanotify_init ()
-requires the
-.B CAP_SYS_ADMIN
-capability.
-This constraint might be relaxed in future versions of the API.
-Therefore, certain additional capability checks have been implemented as
-indicated below.
-.PP
The
.I flags
argument contains a multi-bit field defining the notification class of the
@@ -86,6 +77,9 @@ It is intended for event listeners that need to access files before they
contain their final data.
This notification class might be used by hierarchical storage managers,
for example.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
.TP
.B FAN_CLASS_CONTENT
This value allows the receipt of events notifying that a file has been
@@ -94,6 +88,9 @@ It is intended for event listeners that need to access files when they
already contain their final content.
This notification class might be used by malware detection programs, for
example.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
.TP
.B FAN_CLASS_NOTIF
This is the default value.
@@ -155,6 +152,9 @@ supplied to
.BR read (2)
(see
.BR fanotify (7)).
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
.TP
.BR FAN_ENABLE_AUDIT " (since Linux 4.15)"
.\" commit de8cd83e91bc3ee212b3e6ec6e4283af9e4ab269
@@ -163,6 +163,9 @@ permission events.
The permission event response has to be marked with the
.B FAN_AUDIT
flag for an audit log record to be generated.
+Use of this flag requires the
+.B CAP_AUDIT_WRITE
+capability.
.TP
.BR FAN_REPORT_FID " (since Linux 5.1)"
.\" commit a8b13aa20afb69161b5123b4f1acc7ea0a03d360
@@ -378,13 +381,63 @@ The fanotify API is available only if the kernel was configured with
.BR CONFIG_FANOTIFY .
.TP
.B EPERM
-The operation is not permitted because the caller lacks the
-.B CAP_SYS_ADMIN
-capability.
+The operation is not permitted because the caller lacks a required capability.
.SH VERSIONS
.BR fanotify_init ()
was introduced in version 2.6.36 of the Linux kernel and enabled in version
2.6.37.
+.PP
+Prior to Linux 5.13,
+.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
+calling
+.BR fanotify_init ()
+required the
+.B CAP_SYS_ADMIN
+capability.
+Since Linux 5.13,
+.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
+users may call
+.BR fanotify_init ()
+without the
+.B CAP_SYS_ADMIN
+capability to create and intialize an fanotify group with limited functionality.
+.TP
+The limitations imposed on an event listener created by a user without the
+.B CAP_SYS_ADMIN
+capability are as follows:
+.RS
+.IP * 3
+The user cannot request for an unlimited event queue by using
+.BR FAN_UNLIMITED_QUEUE .
+.IP * 3
+The user cannot request for an unlimited number of marks by using
+.BR FAN_UNLIMITED_MARKS .
+.IP * 3
+The user cannot request to use either notification classes
+.BR FAN_CLASS_CONTENT
+or
+.BR FAN_CLASS_PRE_CONTENT .
+This means that user cannot request permission events.
+.IP * 3
+The user is required to create a group that identifies filesystem objects by
+file handles, for example, by providing the
+.BR FAN_REPORT_FID
+flag.
+.IP * 3
+The user is limited to only mark inodes.
+The ability to mark a mount or filesystem via
+.BR fanotify_mark()
+through the use of
+.BR FAN_MARK_MOUNT
+or
+.BR FAN_MARK_FILESYSTEM
+is not permitted.
+.IP * 3
+The event object in the event queue is limited in terms of the information
+that is made available to the unprivileged user.
+A user will also not receive the pid that generated the event, unless the
+listening process itself generated the event.
+.RE
.SH CONFORMING TO
This system call is Linux-specific.
.SH BUGS
diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
index 036f56ebf..9cf71320c 100644
--- a/man2/fanotify_mark.2
+++ b/man2/fanotify_mark.2
@@ -142,6 +142,9 @@ contains
Attempting to do so will result in the error
.B EINVAL
being returned.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
.TP
.BR FAN_MARK_FILESYSTEM " (since Linux 4.20)"
.\" commit d54f4fba889b205e9cd8239182ca5d27d0ac3bc2
@@ -152,6 +155,9 @@ The filesystem containing
will be marked.
All the contained files and directories of the filesystem from any mount
point will be monitored.
+Use of this flag requires the
+.B CAP_SYS_ADMIN
+capability.
.TP
.B FAN_MARK_IGNORED_MASK
The events in
@@ -454,6 +460,9 @@ handles.
This error can be returned only with an fanotify group that identifies
filesystem objects by file handles.
.TP
+.B EPERM
+The operation is not permitted because the caller lacks a required capability.
+.TP
.B EXDEV
The filesystem object indicated by
.I pathname
--
2.33.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v2 1/4] fanotify_init.2, fanotify_mark.2: Document unprivileged listener
2021-11-20 17:12 ` [PATCH v2 1/4] fanotify_init.2, fanotify_mark.2: Document unprivileged listener Amir Goldstein
@ 2021-11-20 17:19 ` Amir Goldstein
0 siblings, 0 replies; 10+ messages in thread
From: Amir Goldstein @ 2021-11-20 17:19 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: Michael Kerrisk, Jan Kara, Matthew Bobrowski, linux-man
On Sat, Nov 20, 2021 at 7:12 PM Amir Goldstein <amir73il@gmail.com> wrote:
>
> From: Matthew Bobrowski <mbobrowski@mbobrowski.org>
>
> Document the limited fanotify functionality that will be available for
> unprivileged users from kernel v5.13.
>
> Signed-off-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
> Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Forgot to add
Reviewed-by: Jan Kara <jack@suse.cz>
From:
https://lore.kernel.org/linux-man/20210319102532.GA4910@quack2.suse.cz/
> ---
> man2/fanotify_init.2 | 77 +++++++++++++++++++++++++++++++++++++-------
> man2/fanotify_mark.2 | 9 ++++++
> 2 files changed, 74 insertions(+), 12 deletions(-)
>
> diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
> index 2b44fc6ec..b2ceb17f3 100644
> --- a/man2/fanotify_init.2
> +++ b/man2/fanotify_init.2
> @@ -57,15 +57,6 @@ In the current implementation, the number of fanotify groups per user is
> limited to 128.
> This limit cannot be overridden.
> .PP
> -Calling
> -.BR fanotify_init ()
> -requires the
> -.B CAP_SYS_ADMIN
> -capability.
> -This constraint might be relaxed in future versions of the API.
> -Therefore, certain additional capability checks have been implemented as
> -indicated below.
> -.PP
> The
> .I flags
> argument contains a multi-bit field defining the notification class of the
> @@ -86,6 +77,9 @@ It is intended for event listeners that need to access files before they
> contain their final data.
> This notification class might be used by hierarchical storage managers,
> for example.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
> .TP
> .B FAN_CLASS_CONTENT
> This value allows the receipt of events notifying that a file has been
> @@ -94,6 +88,9 @@ It is intended for event listeners that need to access files when they
> already contain their final content.
> This notification class might be used by malware detection programs, for
> example.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
> .TP
> .B FAN_CLASS_NOTIF
> This is the default value.
> @@ -155,6 +152,9 @@ supplied to
> .BR read (2)
> (see
> .BR fanotify (7)).
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
> .TP
> .BR FAN_ENABLE_AUDIT " (since Linux 4.15)"
> .\" commit de8cd83e91bc3ee212b3e6ec6e4283af9e4ab269
> @@ -163,6 +163,9 @@ permission events.
> The permission event response has to be marked with the
> .B FAN_AUDIT
> flag for an audit log record to be generated.
> +Use of this flag requires the
> +.B CAP_AUDIT_WRITE
> +capability.
> .TP
> .BR FAN_REPORT_FID " (since Linux 5.1)"
> .\" commit a8b13aa20afb69161b5123b4f1acc7ea0a03d360
> @@ -378,13 +381,63 @@ The fanotify API is available only if the kernel was configured with
> .BR CONFIG_FANOTIFY .
> .TP
> .B EPERM
> -The operation is not permitted because the caller lacks the
> -.B CAP_SYS_ADMIN
> -capability.
> +The operation is not permitted because the caller lacks a required capability.
> .SH VERSIONS
> .BR fanotify_init ()
> was introduced in version 2.6.36 of the Linux kernel and enabled in version
> 2.6.37.
> +.PP
> +Prior to Linux 5.13,
> +.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
> +calling
> +.BR fanotify_init ()
> +required the
> +.B CAP_SYS_ADMIN
> +capability.
> +Since Linux 5.13,
> +.\" commit 7cea2a3c505e87a9d6afc78be4a7f7be636a73a7
> +users may call
> +.BR fanotify_init ()
> +without the
> +.B CAP_SYS_ADMIN
> +capability to create and intialize an fanotify group with limited functionality.
> +.TP
> +The limitations imposed on an event listener created by a user without the
> +.B CAP_SYS_ADMIN
> +capability are as follows:
> +.RS
> +.IP * 3
> +The user cannot request for an unlimited event queue by using
> +.BR FAN_UNLIMITED_QUEUE .
> +.IP * 3
> +The user cannot request for an unlimited number of marks by using
> +.BR FAN_UNLIMITED_MARKS .
> +.IP * 3
> +The user cannot request to use either notification classes
> +.BR FAN_CLASS_CONTENT
> +or
> +.BR FAN_CLASS_PRE_CONTENT .
> +This means that user cannot request permission events.
> +.IP * 3
> +The user is required to create a group that identifies filesystem objects by
> +file handles, for example, by providing the
> +.BR FAN_REPORT_FID
> +flag.
> +.IP * 3
> +The user is limited to only mark inodes.
> +The ability to mark a mount or filesystem via
> +.BR fanotify_mark()
> +through the use of
> +.BR FAN_MARK_MOUNT
> +or
> +.BR FAN_MARK_FILESYSTEM
> +is not permitted.
> +.IP * 3
> +The event object in the event queue is limited in terms of the information
> +that is made available to the unprivileged user.
> +A user will also not receive the pid that generated the event, unless the
> +listening process itself generated the event.
> +.RE
> .SH CONFORMING TO
> This system call is Linux-specific.
> .SH BUGS
> diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
> index 036f56ebf..9cf71320c 100644
> --- a/man2/fanotify_mark.2
> +++ b/man2/fanotify_mark.2
> @@ -142,6 +142,9 @@ contains
> Attempting to do so will result in the error
> .B EINVAL
> being returned.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
> .TP
> .BR FAN_MARK_FILESYSTEM " (since Linux 4.20)"
> .\" commit d54f4fba889b205e9cd8239182ca5d27d0ac3bc2
> @@ -152,6 +155,9 @@ The filesystem containing
> will be marked.
> All the contained files and directories of the filesystem from any mount
> point will be monitored.
> +Use of this flag requires the
> +.B CAP_SYS_ADMIN
> +capability.
> .TP
> .B FAN_MARK_IGNORED_MASK
> The events in
> @@ -454,6 +460,9 @@ handles.
> This error can be returned only with an fanotify group that identifies
> filesystem objects by file handles.
> .TP
> +.B EPERM
> +The operation is not permitted because the caller lacks a required capability.
> +.TP
> .B EXDEV
> The filesystem object indicated by
> .I pathname
> --
> 2.33.1
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 2/4] fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits
2021-11-20 17:12 [PATCH v2 0/4] fanotify man page updates for v5.13 Amir Goldstein
2021-11-20 17:12 ` [PATCH v2 1/4] fanotify_init.2, fanotify_mark.2: Document unprivileged listener Amir Goldstein
@ 2021-11-20 17:12 ` Amir Goldstein
2021-11-20 17:19 ` Amir Goldstein
2021-11-20 17:12 ` [PATCH v2 3/4] fanotify_mark.2: Update w.r.t tmpfs support Amir Goldstein
` (2 subsequent siblings)
4 siblings, 1 reply; 10+ messages in thread
From: Amir Goldstein @ 2021-11-20 17:12 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: Michael Kerrisk, Jan Kara, Matthew Bobrowski, linux-man
Update documentation about the new configurable fanotify limits
that will be available from Linux kernel 5.13.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
man2/fanotify_init.2 | 22 ++++++++++++++++------
man2/fanotify_mark.2 | 5 ++++-
man7/fanotify.7 | 35 +++++++++++++++++++++++++++++++++--
3 files changed, 53 insertions(+), 9 deletions(-)
diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index b2ceb17f3..0d83e817f 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -53,9 +53,10 @@ descriptor.
Multiple programs may be using the fanotify interface at the same time to
monitor the same files.
.PP
-In the current implementation, the number of fanotify groups per user is
-limited to 128.
-This limit cannot be overridden.
+The number of fanotify groups per user is limited.
+See
+.BR fanotify (7)
+for details about this limit.
.PP
The
.I flags
@@ -130,13 +131,19 @@ fails with the error
.BR EAGAIN .
.TP
.B FAN_UNLIMITED_QUEUE
-Remove the limit of 16384 events for the event queue.
+Remove the limit on the number of events in the event queue.
+See
+.BR fanotify (7)
+for details about this limit.
Use of this flag requires the
.B CAP_SYS_ADMIN
capability.
.TP
.B FAN_UNLIMITED_MARKS
-Remove the limit of 8192 marks.
+Remove the limit on the number of fanotify marks per user.
+See
+.BR fanotify (7)
+for details about this limit.
Use of this flag requires the
.B CAP_SYS_ADMIN
capability.
@@ -366,7 +373,10 @@ defines all allowable bits for
.IR flags .
.TP
.B EMFILE
-The number of fanotify groups for this user exceeds 128.
+The number of fanotify groups for this user exceeds the limit.
+See
+.BR fanotify (7)
+for details about this limit.
.TP
.B EMFILE
The per-process limit on the number of open file descriptors has been reached.
diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
index 9cf71320c..cb69ac592 100644
--- a/man2/fanotify_mark.2
+++ b/man2/fanotify_mark.2
@@ -431,10 +431,13 @@ which is not marked.
The necessary memory could not be allocated.
.TP
.B ENOSPC
-The number of marks exceeds the limit of 8192 and the
+The number of marks for this user exceeds the limit and the
.B FAN_UNLIMITED_MARKS
flag was not specified when the fanotify file descriptor was created with
.BR fanotify_init (2).
+See
+.BR fanotify (7)
+for details about this limit.
.TP
.B ENOSYS
This kernel does not implement
diff --git a/man7/fanotify.7 b/man7/fanotify.7
index 9c66c24f0..455e3ed17 100644
--- a/man7/fanotify.7
+++ b/man7/fanotify.7
@@ -336,7 +336,7 @@ A file or directory that was opened read-only
was closed.
.TP
.B FAN_Q_OVERFLOW
-The event queue exceeded the limit of 16384 entries.
+The event queue exceeded the limit on number of events.
This limit can be overridden by specifying the
.BR FAN_UNLIMITED_QUEUE
flag when calling
@@ -606,7 +606,7 @@ are freed for reuse by the kernel.
Upon
.BR close (2),
outstanding permission events will be set to allowed.
-.SS /proc/[pid]/fdinfo
+.SS /proc interfaces
The file
.I /proc/[pid]/fdinfo/[fd]
contains information about fanotify marks for file descriptor
@@ -616,6 +616,37 @@ of process
See
.BR proc (5)
for details.
+.PP
+Since Linux 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the following interfaces can be used to control the amount of
+kernel resources consumed by fanotify:
+.TP
+.I /proc/sys/fs/fanotify/max_queued_events
+The value in this file is used when an application calls
+.BR fanotify_init (2)
+to set an upper limit on the number of events that can be
+queued to the corresponding fanotify group.
+Events in excess of this limit are dropped, but an
+.B FAN_Q_OVERFLOW
+event is always generated.
+Prior to Linux kernel 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the hardcoded limit was 16384 events.
+.TP
+.I /proc/sys/fs/fanotify/max_user_group
+This specifies an upper limit on the number of fanotify groups
+that can be created per real user ID.
+Prior to Linux kernel 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the hardcoded limit was 128 groups per user.
+.TP
+.I /proc/sys/fs/fanotify/max_user_marks
+This specifies an upper limit on the number of fanotify marks
+that can be created per real user ID.
+Prior to Linux kernel 5.13,
+.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
+the hardcoded limit was 8192 marks per group (not per user).
.SH ERRORS
In addition to the usual errors for
.BR read (2),
--
2.33.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v2 2/4] fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits
2021-11-20 17:12 ` [PATCH v2 2/4] fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits Amir Goldstein
@ 2021-11-20 17:19 ` Amir Goldstein
0 siblings, 0 replies; 10+ messages in thread
From: Amir Goldstein @ 2021-11-20 17:19 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: Michael Kerrisk, Jan Kara, Matthew Bobrowski, linux-man
On Sat, Nov 20, 2021 at 7:12 PM Amir Goldstein <amir73il@gmail.com> wrote:
>
> Update documentation about the new configurable fanotify limits
> that will be available from Linux kernel 5.13.
>
> Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Forgot to add
Reviewed-by: Jan Kara <jack@suse.cz>
From:
https://lore.kernel.org/linux-man/20210319102532.GA4910@quack2.suse.cz/
> ---
> man2/fanotify_init.2 | 22 ++++++++++++++++------
> man2/fanotify_mark.2 | 5 ++++-
> man7/fanotify.7 | 35 +++++++++++++++++++++++++++++++++--
> 3 files changed, 53 insertions(+), 9 deletions(-)
>
> diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
> index b2ceb17f3..0d83e817f 100644
> --- a/man2/fanotify_init.2
> +++ b/man2/fanotify_init.2
> @@ -53,9 +53,10 @@ descriptor.
> Multiple programs may be using the fanotify interface at the same time to
> monitor the same files.
> .PP
> -In the current implementation, the number of fanotify groups per user is
> -limited to 128.
> -This limit cannot be overridden.
> +The number of fanotify groups per user is limited.
> +See
> +.BR fanotify (7)
> +for details about this limit.
> .PP
> The
> .I flags
> @@ -130,13 +131,19 @@ fails with the error
> .BR EAGAIN .
> .TP
> .B FAN_UNLIMITED_QUEUE
> -Remove the limit of 16384 events for the event queue.
> +Remove the limit on the number of events in the event queue.
> +See
> +.BR fanotify (7)
> +for details about this limit.
> Use of this flag requires the
> .B CAP_SYS_ADMIN
> capability.
> .TP
> .B FAN_UNLIMITED_MARKS
> -Remove the limit of 8192 marks.
> +Remove the limit on the number of fanotify marks per user.
> +See
> +.BR fanotify (7)
> +for details about this limit.
> Use of this flag requires the
> .B CAP_SYS_ADMIN
> capability.
> @@ -366,7 +373,10 @@ defines all allowable bits for
> .IR flags .
> .TP
> .B EMFILE
> -The number of fanotify groups for this user exceeds 128.
> +The number of fanotify groups for this user exceeds the limit.
> +See
> +.BR fanotify (7)
> +for details about this limit.
> .TP
> .B EMFILE
> The per-process limit on the number of open file descriptors has been reached.
> diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
> index 9cf71320c..cb69ac592 100644
> --- a/man2/fanotify_mark.2
> +++ b/man2/fanotify_mark.2
> @@ -431,10 +431,13 @@ which is not marked.
> The necessary memory could not be allocated.
> .TP
> .B ENOSPC
> -The number of marks exceeds the limit of 8192 and the
> +The number of marks for this user exceeds the limit and the
> .B FAN_UNLIMITED_MARKS
> flag was not specified when the fanotify file descriptor was created with
> .BR fanotify_init (2).
> +See
> +.BR fanotify (7)
> +for details about this limit.
> .TP
> .B ENOSYS
> This kernel does not implement
> diff --git a/man7/fanotify.7 b/man7/fanotify.7
> index 9c66c24f0..455e3ed17 100644
> --- a/man7/fanotify.7
> +++ b/man7/fanotify.7
> @@ -336,7 +336,7 @@ A file or directory that was opened read-only
> was closed.
> .TP
> .B FAN_Q_OVERFLOW
> -The event queue exceeded the limit of 16384 entries.
> +The event queue exceeded the limit on number of events.
> This limit can be overridden by specifying the
> .BR FAN_UNLIMITED_QUEUE
> flag when calling
> @@ -606,7 +606,7 @@ are freed for reuse by the kernel.
> Upon
> .BR close (2),
> outstanding permission events will be set to allowed.
> -.SS /proc/[pid]/fdinfo
> +.SS /proc interfaces
> The file
> .I /proc/[pid]/fdinfo/[fd]
> contains information about fanotify marks for file descriptor
> @@ -616,6 +616,37 @@ of process
> See
> .BR proc (5)
> for details.
> +.PP
> +Since Linux 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the following interfaces can be used to control the amount of
> +kernel resources consumed by fanotify:
> +.TP
> +.I /proc/sys/fs/fanotify/max_queued_events
> +The value in this file is used when an application calls
> +.BR fanotify_init (2)
> +to set an upper limit on the number of events that can be
> +queued to the corresponding fanotify group.
> +Events in excess of this limit are dropped, but an
> +.B FAN_Q_OVERFLOW
> +event is always generated.
> +Prior to Linux kernel 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the hardcoded limit was 16384 events.
> +.TP
> +.I /proc/sys/fs/fanotify/max_user_group
> +This specifies an upper limit on the number of fanotify groups
> +that can be created per real user ID.
> +Prior to Linux kernel 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the hardcoded limit was 128 groups per user.
> +.TP
> +.I /proc/sys/fs/fanotify/max_user_marks
> +This specifies an upper limit on the number of fanotify marks
> +that can be created per real user ID.
> +Prior to Linux kernel 5.13,
> +.\" commit 5b8fea65d197f408bb00b251c70d842826d6b70b
> +the hardcoded limit was 8192 marks per group (not per user).
> .SH ERRORS
> In addition to the usual errors for
> .BR read (2),
> --
> 2.33.1
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 3/4] fanotify_mark.2: Update w.r.t tmpfs support
2021-11-20 17:12 [PATCH v2 0/4] fanotify man page updates for v5.13 Amir Goldstein
2021-11-20 17:12 ` [PATCH v2 1/4] fanotify_init.2, fanotify_mark.2: Document unprivileged listener Amir Goldstein
2021-11-20 17:12 ` [PATCH v2 2/4] fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits Amir Goldstein
@ 2021-11-20 17:12 ` Amir Goldstein
2021-11-20 17:12 ` [PATCH v2 4/4] fanotify_init.2: Document kernel commits Amir Goldstein
2021-11-22 16:56 ` [PATCH v2 0/4] fanotify man page updates for v5.13 Alejandro Colomar (man-pages)
4 siblings, 0 replies; 10+ messages in thread
From: Amir Goldstein @ 2021-11-20 17:12 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: Michael Kerrisk, Jan Kara, Matthew Bobrowski, linux-man
tmpfs can be watched with FAN_REPORT_FID since kernel v5.13.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
man2/fanotify_mark.2 | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/man2/fanotify_mark.2 b/man2/fanotify_mark.2
index cb69ac592..92309e684 100644
--- a/man2/fanotify_mark.2
+++ b/man2/fanotify_mark.2
@@ -414,7 +414,12 @@ The filesystem object indicated by
is not associated with a filesystem that supports
.I fsid
(e.g.,
-.BR tmpfs (5)).
+.BR fuse (4)).
+.BR tmpfs (5)
+did not support
+.I fsid
+prior to Linux 5.13.
+.\" commit 59cda49ecf6c9a32fae4942420701b6e087204f6
This error can be returned only with an fanotify group that identifies
filesystem objects by file handles.
.TP
--
2.33.1
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH v2 4/4] fanotify_init.2: Document kernel commits
2021-11-20 17:12 [PATCH v2 0/4] fanotify man page updates for v5.13 Amir Goldstein
` (2 preceding siblings ...)
2021-11-20 17:12 ` [PATCH v2 3/4] fanotify_mark.2: Update w.r.t tmpfs support Amir Goldstein
@ 2021-11-20 17:12 ` Amir Goldstein
2021-11-22 16:56 ` [PATCH v2 0/4] fanotify man page updates for v5.13 Alejandro Colomar (man-pages)
4 siblings, 0 replies; 10+ messages in thread
From: Amir Goldstein @ 2021-11-20 17:12 UTC (permalink / raw)
To: Alejandro Colomar; +Cc: Michael Kerrisk, Jan Kara, Matthew Bobrowski, linux-man
Document the kernel commits that added support for FAN_REPORT_DIR_FID
and FAN_REPORT_NAME.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
man2/fanotify_init.2 | 2 ++
1 file changed, 2 insertions(+)
diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index 0d83e817f..7a1c21037 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -213,6 +213,7 @@ See
for additional details.
.TP
.BR FAN_REPORT_DIR_FID " (since Linux 5.9)"
+.\" commit 83b7a59896dd24015a34b7f00027f0ff3747972f
Events for fanotify groups initialized with this flag will contain
(see exceptions below) additional information about a directory object
correlated to an event.
@@ -245,6 +246,7 @@ See
for additional details.
.TP
.BR FAN_REPORT_NAME " (since Linux 5.9)"
+.\" commit 929943b38daf817f2e6d303ea04401651fc3bc05
Events for fanotify groups initialized with this flag will contain additional
information about the name of the directory entry correlated to an event.
This flag must be provided in conjunction with the flag
--
2.33.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v2 0/4] fanotify man page updates for v5.13
2021-11-20 17:12 [PATCH v2 0/4] fanotify man page updates for v5.13 Amir Goldstein
` (3 preceding siblings ...)
2021-11-20 17:12 ` [PATCH v2 4/4] fanotify_init.2: Document kernel commits Amir Goldstein
@ 2021-11-22 16:56 ` Alejandro Colomar (man-pages)
2021-12-10 9:37 ` Amir Goldstein
4 siblings, 1 reply; 10+ messages in thread
From: Alejandro Colomar (man-pages) @ 2021-11-22 16:56 UTC (permalink / raw)
To: Amir Goldstein, Matthew Bobrowski; +Cc: Michael Kerrisk, Jan Kara, linux-man
Hi Amir,
On 11/20/21 18:12, Amir Goldstein wrote:
> Hi Alejandro,
>
> This is a re-post of updates for v5.13 that I posted last March [1].
>
> Thanks,
> Amir.
>
> Changes since v1:
> - Update comment regarding tmpfs
> - Document kernel commits
>
> [1] https://lore.kernel.org/linux-man/20210318160817.3586288-1-amir73il@gmail.com/
>
> Amir Goldstein (3):
> fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits
> fanotify_mark.2: Update w.r.t tmpfs support
> fanotify_init.2: Document kernel commits
>
> Matthew Bobrowski (1):
> fanotify_init.2, fanotify_mark.2: Document unprivileged listener
Patch set applied.
See some tweaks below.
Thanks!
Alex
---
fanotify_init.2: Minor tweaks to Matthew's patch
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
Cc: Matthew Bobrowski <mbobrowski@mbobrowski.org>
Cc: Amir Goldstein <amir73il@gmail.com>
diff --git a/man2/fanotify_init.2 b/man2/fanotify_init.2
index 7a1c21037..e463372f3 100644
--- a/man2/fanotify_init.2
+++ b/man2/fanotify_init.2
@@ -426,23 +426,23 @@ The user cannot request for an unlimited number of
marks by using
.BR FAN_UNLIMITED_MARKS .
.IP * 3
The user cannot request to use either notification classes
-.BR FAN_CLASS_CONTENT
+.B FAN_CLASS_CONTENT
or
.BR FAN_CLASS_PRE_CONTENT .
This means that user cannot request permission events.
.IP * 3
The user is required to create a group that identifies filesystem
objects by
file handles, for example, by providing the
-.BR FAN_REPORT_FID
+.B FAN_REPORT_FID
flag.
.IP * 3
The user is limited to only mark inodes.
The ability to mark a mount or filesystem via
-.BR fanotify_mark()
+.BR fanotify_mark ()
through the use of
-.BR FAN_MARK_MOUNT
+.B FAN_MARK_MOUNT
or
-.BR FAN_MARK_FILESYSTEM
+.B FAN_MARK_FILESYSTEM
is not permitted.
.IP * 3
The event object in the event queue is limited in terms of the information
--
Alejandro Colomar
Linux man-pages comaintainer; http://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v2 0/4] fanotify man page updates for v5.13
2021-11-22 16:56 ` [PATCH v2 0/4] fanotify man page updates for v5.13 Alejandro Colomar (man-pages)
@ 2021-12-10 9:37 ` Amir Goldstein
2021-12-10 13:56 ` Alejandro Colomar (man-pages)
0 siblings, 1 reply; 10+ messages in thread
From: Amir Goldstein @ 2021-12-10 9:37 UTC (permalink / raw)
To: Alejandro Colomar (man-pages)
Cc: Matthew Bobrowski, Michael Kerrisk, Jan Kara, linux-man,
Gabriel Krisman Bertazi
On Mon, Nov 22, 2021 at 6:57 PM Alejandro Colomar (man-pages)
<alx.manpages@gmail.com> wrote:
>
> Hi Amir,
>
> On 11/20/21 18:12, Amir Goldstein wrote:
> > Hi Alejandro,
> >
> > This is a re-post of updates for v5.13 that I posted last March [1].
> >
> > Thanks,
> > Amir.
> >
> > Changes since v1:
> > - Update comment regarding tmpfs
> > - Document kernel commits
> >
> > [1] https://lore.kernel.org/linux-man/20210318160817.3586288-1-amir73il@gmail.com/
> >
> > Amir Goldstein (3):
> > fanotify_init.2, fanotify_mark.2, fanotify.7: Configurable limits
> > fanotify_mark.2: Update w.r.t tmpfs support
> > fanotify_init.2: Document kernel commits
> >
> > Matthew Bobrowski (1):
> > fanotify_init.2, fanotify_mark.2: Document unprivileged listener
>
> Patch set applied.
> See some tweaks below.
>
I understand that the patches were applied to your github tree main branch [1]
Should we regard that branch as the "next" branch and base our next
fanotify man page updates (i.e. FAN_REPORT_PIDFD) on top of it?
Thanks,
Amir.
[1] https://github.com/alejandro-colomar/man-pages.git
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2 0/4] fanotify man page updates for v5.13
2021-12-10 9:37 ` Amir Goldstein
@ 2021-12-10 13:56 ` Alejandro Colomar (man-pages)
0 siblings, 0 replies; 10+ messages in thread
From: Alejandro Colomar (man-pages) @ 2021-12-10 13:56 UTC (permalink / raw)
To: Amir Goldstein
Cc: Matthew Bobrowski, Michael Kerrisk, Jan Kara, linux-man,
Gabriel Krisman Bertazi
Hi, Amir!
On 12/10/21 10:37, Amir Goldstein wrote:
> On Mon, Nov 22, 2021 at 6:57 PM Alejandro Colomar (man-pages)
> <alx.manpages@gmail.com> wrote:
>> Patch set applied.
>> See some tweaks below.
>>
>
> I understand that the patches were applied to your github tree main branch [1]
Yes.
>
> Should we regard that branch as the "next" branch and base our next
> fanotify man page updates (i.e. FAN_REPORT_PIDFD) on top of it?
And yes.
Thanks,
Alex
--
Alejandro Colomar
Linux man-pages maintainer; https://www.kernel.org/doc/man-pages/
^ permalink raw reply [flat|nested] 10+ messages in thread