From patchwork Mon Jul 16 08:50:11 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Matthew Bobrowski X-Patchwork-Id: 10526251 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 247F660348 for ; Mon, 16 Jul 2018 08:50:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0BBAA287E5 for ; Mon, 16 Jul 2018 08:50:21 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F3C35287F4; Mon, 16 Jul 2018 08:50:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CAA2C287E5 for ; Mon, 16 Jul 2018 08:50:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728324AbeGPJQj (ORCPT ); Mon, 16 Jul 2018 05:16:39 -0400 Received: from mail-pl0-f68.google.com ([209.85.160.68]:34262 "EHLO mail-pl0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727649AbeGPJQj (ORCPT ); Mon, 16 Jul 2018 05:16:39 -0400 Received: by mail-pl0-f68.google.com with SMTP id f6-v6so1049304plo.1 for ; Mon, 16 Jul 2018 01:50:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mbobrowski-org.20150623.gappssmtp.com; s=20150623; h=message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=KqYKEYTXfuU3ZrtHUsAlCIYFiKxsCxcikahUAzQ8fGM=; b=dJT6hWuJWH20/3AVYYmNHbeQo7dq+RflXt2D/imQdEwZqBHGqLJgvXi2AcFfyftabT 8mzTMycc1EbQcQV8NlqS9+HjriFtZSSJpeu5NWrZwGVD114TnkFCTap7w+al/JkR6A9K qRCRG3HOUSfaFK33A/PVxOiB+8tssmzSAjT5JxfrdFNdMT4zOZkHBSurYF+OjVxl9ftF HmgVeYhAORHQ/t5K5HuoG5cO+F5QdAcBgi5OYyOy9uaFsboYlmvB96YBfDyy2LGC1TW/ n0xT4TFWQglSggt9/cQX3jzpPku4/8VKim8uByfk34jBHsiu6CpJSQp1w9KmBR3QaZ02 NPMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=KqYKEYTXfuU3ZrtHUsAlCIYFiKxsCxcikahUAzQ8fGM=; b=Zp35YpXZU7n5frj7L5PYZ3SNIESPASXqdpkvlcsAC1k7Go+UBvXbo1IINZkH3hLI2X e4IxAoDoWQsZbHYcknKwkyCdaD6sbqDcaRIkC3q+x7Zobr43kMljEeSuYQvH2HXJMx3P hdUUa913qRZX5tY0UtqCuPQFSNG/jOJorxRy4Np3zprGdCUtA1+JJZQHv4KsWM6DvmoH h0pLayaap7VQkJ8zrKg9SoPCt24DKbc/E6kjmDMpsezJV1kL3t9srT6/PQKjo49BhebL 4UBigP1mrJPh2u5Om2lvFrGhi4tjYYookww5uhrpEQevgZkr7WKdo808ikpw3zMWz9lP HBpw== X-Gm-Message-State: AOUpUlELdGzrJkI9aZt3ZBsn+f+R+ycvxAZLFmK4OeytH6P1z9cbKLyz 1pui77OV4LzctVY5rmy/B18tCJeNStnk X-Google-Smtp-Source: AAOMgpdsl44S+xQ5ZIkEwXGn0Kf0LjahYA08xzn83Lb6FUay1gCxPRkyNtzh4tre29dut72vKcWwdw== X-Received: by 2002:a17:902:583:: with SMTP id f3-v6mr15891395plf.115.1531731016782; Mon, 16 Jul 2018 01:50:16 -0700 (PDT) Received: from workstation.internal.lab (n114-74-211-86.sbr2.nsw.optusnet.com.au. [114.74.211.86]) by smtp.gmail.com with ESMTPSA id h7-v6sm50785842pfd.155.2018.07.16.01.50.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 16 Jul 2018 01:50:16 -0700 (PDT) Message-ID: <1531731011.19075.11.camel@mbobrowski.org> Subject: [PATCH] fanotify: introduce event flags FAN_EXEC and FAN_EXEC_PERM From: Matthew Bobrowski To: jack@suse.cz Cc: amir73il@gmail.com, linux-fsdevel@vger.kernel.org, Steve Grubb Date: Mon, 16 Jul 2018 18:50:11 +1000 X-Mailer: Evolution 3.22.6 (3.22.6-14.el7) Mime-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently, the fanotify API does not provide a means for user space programs to register and receive events specifically when a file has been opened with the intent to be executed. Two new event flags FAN_EXEC and FAN_EXEC_PERM have been introduced to the fanotify API along with updates to the generic filesystem notification hooks fsnotify_open and fsnotify_perm in order to support this capability. Signed-off-by: Matthew Bobrowski --- The proposed changes have been tested against Linus' mainline source tree along with testing them against stable kernel releases 4.17.4, 4.17.5 and 4.17.6. --- in perm check */ +#define FAN_EXEC_PERM 0x00040000 /* File executed in perm check */    #define FAN_ONDIR 0x40000000 /* event occurred against dir */   @@ -69,13 +71,15 @@  #define FAN_ALL_EVENTS (FAN_ACCESS |\   FAN_MODIFY |\   FAN_CLOSE |\ - FAN_OPEN) + FAN_OPEN |\ + FAN_EXEC)    /*   * All events which require a permission response from userspace   */  #define FAN_ALL_PERM_EVENTS (FAN_OPEN_PERM |\ -      FAN_ACCESS_PERM) +      FAN_ACCESS_PERM |\ +      FAN_EXEC_PERM)    #define FAN_ALL_OUTGOING_EVENTS (FAN_ALL_EVENTS |\    FAN_ALL_PERM_EVENTS |\ diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c index f90842efea13..4882706e2188 100644 --- a/fs/notify/fanotify/fanotify.c +++ b/fs/notify/fanotify/fanotify.c @@ -197,6 +197,8 @@ static int fanotify_handle_event(struct fsnotify_group *group,   BUILD_BUG_ON(FAN_OPEN_PERM != FS_OPEN_PERM);   BUILD_BUG_ON(FAN_ACCESS_PERM != FS_ACCESS_PERM);   BUILD_BUG_ON(FAN_ONDIR != FS_ISDIR); + BUILD_BUG_ON(FAN_EXEC != FS_EXEC); + BUILD_BUG_ON(FAN_EXEC_PERM != FS_EXEC_PERM);     if (!fanotify_should_send_event(iter_info, mask, data, data_type))   return 0; diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c index f174397b63a0..ef5d3eca2e62 100644 --- a/fs/notify/fsnotify.c +++ b/fs/notify/fsnotify.c @@ -393,7 +393,7 @@ static __init int fsnotify_init(void)  {   int ret;   - BUG_ON(hweight32(ALL_FSNOTIFY_EVENTS) != 23); + BUG_ON(hweight32(ALL_FSNOTIFY_EVENTS) != 25);     ret = init_srcu_struct(&fsnotify_mark_srcu);   if (ret) diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h index bdaf22582f6e..db3ee74a7903 100644 --- a/include/linux/fsnotify.h +++ b/include/linux/fsnotify.h @@ -42,9 +42,12 @@ static inline int fsnotify_perm(struct file *file, int mask)   return 0;   if (!(mask & (MAY_READ | MAY_OPEN)))   return 0; - if (mask & MAY_OPEN) + if (mask & MAY_OPEN) {   fsnotify_mask = FS_OPEN_PERM; - else if (mask & MAY_READ) + + if (file->f_flags & FMODE_EXEC) + fsnotify_mask |= FS_EXEC_PERM; + } else if (mask & MAY_READ)   fsnotify_mask = FS_ACCESS_PERM;   else   BUG(); @@ -220,6 +223,9 @@ static inline void fsnotify_open(struct file *file)   if (S_ISDIR(inode->i_mode))   mask |= FS_ISDIR;   + if (file->f_flags & FMODE_EXEC) + mask |= FS_EXEC; +   fsnotify_parent(path, NULL, mask);   fsnotify(inode, mask, path, FSNOTIFY_EVENT_PATH, NULL, 0);  } diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h index b38964a7a521..7179a82d60d4 100644 --- a/include/linux/fsnotify_backend.h +++ b/include/linux/fsnotify_backend.h @@ -38,6 +38,7 @@  #define FS_DELETE 0x00000200 /* Subfile was deleted */  #define FS_DELETE_SELF 0x00000400 /* Self was deleted */  #define FS_MOVE_SELF 0x00000800 /* Self was moved */ +#define FS_EXEC 0x00001000 /* File was executed */    #define FS_UNMOUNT 0x00002000 /* inode on umount fs */  #define FS_Q_OVERFLOW 0x00004000 /* Event queued overflowed */ @@ -45,6 +46,7 @@    #define FS_OPEN_PERM 0x00010000 /* open event in an permission hook */  #define FS_ACCESS_PERM 0x00020000 /* access event in a permissions hook */ +#define FS_EXEC_PERM 0x00040000 /* exec event in permission hook */    #define FS_EXCL_UNLINK 0x04000000 /* do not send events if object is unlinked */  #define FS_ISDIR 0x40000000 /* event occurred against dir */ @@ -62,11 +64,12 @@  #define FS_EVENTS_POSS_ON_CHILD   (FS_ACCESS | FS_MODIFY | FS_ATTRIB |\      FS_CLOSE_WRITE | FS_CLOSE_NOWRITE | FS_OPEN |\      FS_MOVED_FROM | FS_MOVED_TO | FS_CREATE |\ -    FS_DELETE | FS_OPEN_PERM | FS_ACCESS_PERM) +    FS_DELETE | FS_OPEN_PERM | FS_ACCESS_PERM |\ +    FS_EXEC | FS_EXEC_PERM)    #define FS_MOVE (FS_MOVED_FROM | FS_MOVED_TO)   -#define ALL_FSNOTIFY_PERM_EVENTS (FS_OPEN_PERM | FS_ACCESS_PERM) +#define ALL_FSNOTIFY_PERM_EVENTS (FS_OPEN_PERM | FS_ACCESS_PERM | FS_EXEC_PERM)    #define ALL_FSNOTIFY_EVENTS (FS_ACCESS | FS_MODIFY | FS_ATTRIB | \        FS_CLOSE_WRITE | FS_CLOSE_NOWRITE | FS_OPEN | \ @@ -75,7 +78,8 @@        FS_UNMOUNT | FS_Q_OVERFLOW | FS_IN_IGNORED | \        FS_OPEN_PERM | FS_ACCESS_PERM | FS_EXCL_UNLINK | \        FS_ISDIR | FS_IN_ONESHOT | FS_DN_RENAME | \ -      FS_DN_MULTISHOT | FS_EVENT_ON_CHILD) +      FS_DN_MULTISHOT | FS_EVENT_ON_CHILD |\ +      FS_EXEC | FS_EXEC_PERM)    struct fsnotify_group;  struct fsnotify_event; diff --git a/include/uapi/linux/fanotify.h b/include/uapi/linux/fanotify.h index 74247917de04..80822af0eeac 100644 --- a/include/uapi/linux/fanotify.h +++ b/include/uapi/linux/fanotify.h @@ -10,11 +10,13 @@  #define FAN_CLOSE_WRITE 0x00000008 /* Writtable file closed */  #define FAN_CLOSE_NOWRITE 0x00000010 /* Unwrittable file closed */  #define FAN_OPEN 0x00000020 /* File was opened */ +#define FAN_EXEC 0x00001000 /* File was executed */    #define FAN_Q_OVERFLOW 0x00004000 /* Event queued overflowed */    #define FAN_OPEN_PERM 0x00010000 /* File open in perm check */  #define FAN_ACCESS_PERM 0x00020000 /* File accessed